Model Context Protocol

The AWS API MCP Server, an open source Model Context Protocol server for running AWS CLI commands, skips its per-request security policy check for the lifetime of the process if the policy enforcement data fails to load at startup. Deny and gate rules are then not consulted, so restricted AWS API operations execute, though IAM permissions on the configured credentials still apply. Affected versions are >= 0.2.13 and < 1.3.47.

CVE-2026-16584 affects the AWS API MCP Server (awslabs.aws-api-mcp-server) for versions >= 0.2.13 and < 1.3.47. If the server fails to load its optional user-configured security policy at startup, it keeps running with the per-request policy check skipped, so AWS API operations the policy was set to deny or gate can execute without enforcement, provided fail-closed modes are not enabled. IAM permissions on the configured credentials remain in effect.

WhatsApp MCP Server, prior to version 0.2.1, exposes its `whatsapp-bridge` HTTP API on `127.0.0.1:8080` without authentication or Host header validation, and the `/api/send` endpoint accepts an absolute `media_path` without confinement to a safe directory. A local process running as the same user, or a remote attacker via DNS rebinding from a visited webpage, can send messages from the paired account, read arbitrary user-readable files such as SSH keys, and exfiltrate them as WhatsApp attachments.

CVE-2026-7755 affects IBM Langflow OSS versions 1.0.0 through 1.10.0. The flaw is incomplete validation enforcement on MCP server configuration files, which could allow remote code execution. NIST has not yet provided an NVD assessment.

Agentic-Flow, an AI agent orchestration platform, is affected in versions prior to 2.0.14. Several MCP server tool files interpolate attacker-influenceable parameters such as agent, task, name, language and agentdb directly into shell command strings passed to execSync(). This allows arbitrary OS command execution with the privileges of the MCP server user.

The deprecated WebSocket server transport, mcp.server.websocket.websocket_server, in the MCP Python SDK accepted WebSocket handshakes without validating the Host or Origin headers, because TransportSecuritySettings was never wired into it. A malicious web page can open a connection to an exposed server on this transport, complete initialize, and invoke its tools and read its resources, and the transport requires no token or prior session. Only applications that wire this transport into their own ASGI server are affected.

Affected versions of the MCP Python SDK route requests on the SSE and Streamable HTTP transports to an existing session using only the session identifier, without checking that the request carries the same authenticated principal that created the session. Anyone who learns or guesses a session ID, such as the `session_id` query parameter or `Mcp-Session-Id` header, can send JSON-RPC messages into that session regardless of their bearer token. Only servers that use an HTTP transport and built-in bearer-token authentication are affected; stdio, stateless Streamable HTTP, and unauthenticated servers are not.

The MCP Python SDK's experimental task handlers, enabled through `server.experimental.enable_tasks()`, did not check which session created a task before acting on it. On a multi-client server, any connected client could list, read, cancel, and consume queued messages such as elicitation requests belonging to other clients' tasks.

Any authenticated LangBot user can execute arbitrary OS commands on the server by adding an STDIO MCP server with a chosen command in the MCP configuration. The flaw is in src/langbot/pkg/provider/tools/loaders/mcp.py, where StdioServerParameters from the mcp package spawns a subprocess with the supplied command. The advisory rates this as authenticated remote code execution (CWE-78) affecting publicly reachable instances and, from the same network, local instances.

CVE-2026-15643 is a server-side request forgery in the pagination handling of the awslabs.healthlake-mcp-server (AWS HealthLake MCP Server) before 0.0.14, on all platforms. A remote authenticated user can craft a next_token parameter so that the server does not validate the pagination URL against the expected HealthLake endpoint, redirecting requests to an actor-controlled server and exfiltrating AWS temporary security credentials.

The mcp-atlassian server's confluence_upload_attachment tool passes a caller-supplied file_path directly to open() in _upload_attachment_direct() in src/mcp_atlassian/confluence/attachments.py, without the validate_safe_path() check that download_attachment() applies. Any authenticated MCP client, or an AI agent steered by prompt injection, can read files the server process can access and upload them to Confluence as attachments. The source reports this was confirmed against v0.21.1 and that /proc/self/environ, which can expose API tokens and other secrets on a Linux deployment, was exfiltrated.