Model Context Protocol

n8n's `/mcp-oauth/register` endpoint accepts OAuth client registrations without authentication, so arbitrary `redirect_uri` values can be registered. When a user clicks Deny on the MCP OAuth consent dialog, the `handleDeny` handler redirects them to that registered URI without validation, creating an open redirect. An attacker can send a phishing link that silently sends a victim to an external site after they deny consent.

In HTTP transport mode, n8n-mcp versions v2.47.12 and earlier wrote full MCP tools/call arguments and JSON-RPC params to server logs for authenticated requests, before redaction. When a call carried credentials, such as through n8n_manage_credentials.data, the raw values could be persisted in logs, exposing bearer tokens, OAuth credentials, API keys and webhook auth headers to anyone with access to collected or forwarded logs. The issue requires a valid AUTH_TOKEN, and the stdio transport is not affected in practice.

Versions 2.47.10 and earlier of n8n-mcp, when run in HTTP transport mode, wrote request metadata for incoming POST /mcp requests to server logs even when authentication failed. Sensitive values from those rejected requests, including bearer tokens from the Authorization header, per-tenant x-n8n-key API keys, and JSON-RPC payloads, could therefore be persisted and exposed to anyone with access to collected logs. Access control itself was not bypassed, since unauthenticated requests received 401 Unauthorized, and the stdio transport is not affected.

OX Security researchers reported a design weakness in Anthropic's Model Context Protocol (MCP) that enables arbitrary command execution on any system running a vulnerable MCP implementation, exposing user data, internal databases, API keys and chat histories. The flaw sits in unsafe defaults in how MCP configuration works over the STDIO transport, and it is present in Anthropic's official SDK across Python, TypeScript, Java and Rust, affecting more than 7,000 publicly accessible servers and software packages with over 150 million downloads. Anthropic declined to modify the protocol's architecture, and some vendors have issued patches while the reference implementation remains unaddressed.

OX Security researchers report that the STDIO transport in Anthropic's MCP reference implementation lets client applications pass arbitrary commands to StdioServerParameters, which execute with the parent process's permissions, exposing systems to remote code execution. Anthropic, LangChain and FastMCP maintain this is by design and that client developers must sanitize MCP configurations. The researchers say they executed commands on six official services and took over thousands of public servers across more than 200 open-source GitHub projects.

A critical flaw in Nginx UI, a web-based management interface for Nginx with Model Context Protocol (MCP) support, is being actively exploited. Tracked as CVE-2026-33032, it stems from the unprotected '/mcp_message' endpoint, letting remote attackers invoke MCP tools, including config file writes and nginx reloads, without credentials. Pluto Security's scans found 2,600 publicly exposed instances potentially vulnerable.

Pluto Security published details of CVE-2026-33032, a critical flaw in the open-source nginx UI configuration tool, with a CVSS score of 9.8. The flaw sits in the MCP server support added in late 2025, where the /mcp_message endpoint lacks authentication, exposing 12 MCP tools that include config writes with automatic nginx reload. The flaw has been under active exploitation since March, and Pluto Security found 2,689 internet-reachable vulnerable instances using Shodan.

Researchers warn that a flaw in Anthropic's Model Context Protocol lets unsanitized commands execute silently. The flaw could enable full system compromise across widely used AI environments.