Model Context Protocol

CVE-2026-4270 is an Improper Protection of Alternate Path flaw in the no-access and workdir file access features of the AWS API MCP Server, affecting awslabs.aws-api-mcp-server versions >= 0.2.14 and < 1.3.9 on all platforms. The flaw may allow an attacker to bypass the intended file access restriction and expose arbitrary local file contents in the MCP client application context.

The FastMCP OAuth Proxy ignores the client-supplied `resource` parameter in authorization and token requests and issues tokens for the `base_url` set at initialization instead. Because the tokens carry no resource information, a benign MCP server cannot verify that a token was issued for it. An attacker can run a malicious MCP server that advertises the benign proxy as its authorization server, capture the token from a victim's OAuth flow, and replay it against other MCP servers that share that authorization server.

LibreChat versions 0.8.2 through 0.8.2-rc3 have a flaw in the MCP (Model Context Protocol) OAuth callback endpoint. It stores OAuth tokens for the user who started the flow without checking that the browser completing the redirect is logged in or belongs to that same user. An attacker can send a victim the authorization URL, and the victim's tokens for linked services such as Atlassian and Outlook end up on the attacker's account, enabling account takeover.

mcp-atlassian's HTTP middleware and dependency layer accept an unvalidated X-Atlassian-Jira-Url (and the Confluence equivalent) from unauthenticated requests when no Authorization header is present. The server then issues an outbound GET to {header_url}/rest/api/2/myself, enabling server-side request forgery, which the advisory says can expose IAM credentials via 169.254.169.254 in cloud deployments and enable internal network reconnaissance and injection of attacker-controlled content into LLM tool results.

GitHub Copilot CLI's shell tool contains a vulnerability in which crafted bash parameter expansion patterns (such as ${var@P}, assignment forms like ${var=value}, indirect ${!var}, and nested $(cmd) inside ${...}) can hide command execution inside commands the safety assessment classifies as read-only. An attacker who can influence the commands the agent runs, for example through prompt injection in repository files, MCP server responses, or user instructions, could achieve arbitrary code execution on the user's workstation, even in modes that require approval for write operations. The issue affects versions prior to 0.0.423.

The Go MCP SDK parsed JSON-RPC and MCP messages with Go's standard encoding/json.Unmarshal, which matches keys case-insensitively and folds Unicode characters such as ſ (U+017F) and K (U+212A) to ASCII. A malicious MCP peer could send non-standard field casing, such as "Method" instead of "method", that the SDK silently accepted. This could let such messages bypass intermediary proxies or policy layers that match exact field names, and it made the Go SDK inconsistent with the case-sensitive TypeScript and Python SDKs.

CVE-2026-26029 affects sf-mcp-server, an implementation of the Salesforce MCP server for Claude for Desktop. The flaw is an OS command injection (CWE-78) caused by unsafe use of child_process.exec when building Salesforce CLI commands from user-controlled input. Successful exploitation lets an attacker run arbitrary shell commands with the privileges of the MCP server process.