Model Context Protocol

gemini-bridge's consult_gemini_with_files tool, in inline mode, read any file path given in the files argument without confining it to the working directory, then forwarded the contents to the Gemini CLI. Because the caller also controls query, file contents are echoed back through the Gemini round-trip and sent to Google, letting an MCP client or a prompt-injected LLM read any file the server process can access.

Noma Security reported CVE-2026-59726, dubbed RufRoot, a critical flaw (CVSS 10.0) in Ruflo versions prior to 3.16.3. An unauthenticated MCP Bridge, exposed by default, accepts tool invocations at its /mcp endpoint, letting attackers run commands, steal LLM API keys, read user conversations and poison AgentDB memory with a single HTTP request. The researchers validated the attack chain against a default Ruflo deployment on AWS EC2.

Researchers at Noma Labs disclosed CVE-2026-59726 (CVSS 10.0), dubbed RufRoot, in Ruflo, an open-source agent meta-harness for Claude Code and Codex, affecting all versions before 3.16.3. The default docker-compose.yml binds port 3001 to 0.0.0.0, exposing an unauthenticated MCP bridge that exposes 233 tools, including terminal_execute. A single unauthenticated POST to /mcp allows remote code execution, enabling theft of LLM provider API keys, reading of stored conversations, and poisoning of AgentDB memory.

Wiz Research examined MCP servers left reachable from the Internet, often without authentication, and found several run by Fortune 500 companies. These exposed employee PII, internal business records, write and delete operations, and in some cases code execution and cloud credentials. Roughly 1 in 6 cloud environments where MCP was found exposed at least one server.

CVE-2026-66005 affects Jan through 0.8.4 and is fixed in commit 3e1c1e7. The local API server has a CORS misconfiguration: it replaces user-configured trusted hosts with a wildcard that reflects arbitrary origins with credentials. Network-adjacent attackers, or attackers using DNS rebinding, can reach the unauthenticated OpenAI-compatible API to run inference, enumerate models, invoke MCP tools, and read cross-origin responses.

GHSA-q5xf-xhwf-cwqf affects n8n instances running 2.27.0 or later with an active workflow using an MCP Server Trigger node configured with `n8n OAuth2` authentication. The OAuth 2.1 consent and token-issuance flow does not check whether the authenticated user can access the referenced workflow, so a member-level user can self-approve consent for another user's workflow and obtain a valid token. The workflow then runs in the owner's project context with the owner's stored credentials, letting the attacker set inputs and read outputs, which may include data from the owner's connected integrations.

The MCP Client node in n8n sent requests to user-supplied endpoints without routing them through SSRF protection or pinning the resolved address. An authenticated user who could create or edit a workflow could make the server connect to internal or blocked hosts and read the responses back through the workflow. The issue affects instances with SSRF protection enabled.

CVE-2026-44192 is a path traversal flaw in the Ansible Lightspeed Model Context Protocol (MCP) server, classified as CWE-22. An attacker can use indirect prompt injection to manipulate an AI agent, causing the server to write files to unauthorized locations on the user's system. The source says this can expose sensitive host information and enable execution of malicious commands, potentially leading to full system compromise.

A hidden HTML comment in an Azure DevOps pull request description can hijack a reviewer's AI coding agent through Microsoft's official Azure DevOps MCP server. The repo_get_pull_request_by_id tool returns descriptions without the spotlighting guardrail that other tools in the server already apply, which Manifold Security says is the gap. In a proof of concept run on a local build of v2.7.0, the injected instructions led the agent to trigger a pipeline in another project, read a confidential wiki page, and post it back to the PR.

Cybersecurity researchers found nearly 7,600 malicious GitHub repositories created by about 6,600 profiles, more than 800 of which pose as AI skills or Model Context Protocol (MCP) servers to deliver SmartLoader malware in a campaign called FakeGit. The campaign then pushes secondary payloads such as StealC, an information stealer. Island's tests found Anthropic Claude Code, Google Gemini and OpenAI ChatGPT susceptible to surfacing these repositories, a technique it calls AgentBaiting.

GHSA-f7wf-v2vw-mpcx affects mcp-memory-keeper, where the context_import tool passed the caller-supplied filePath directly to fs.readFileSync without path confinement. A malicious MCP client, or an LLM agent prompt-injected into calling the tool, could read any file the server process can access. Valid JSON files are imported in full and retrievable through context_get or context_export, while other files leak their leading bytes through the JSON.parse SyntaxError message.