Model Context Protocol

CVE-2026-59207 is a vulnerability in n8n, an open source workflow automation platform, affecting versions before 2.27.4 and 2.28.1. The AI Agents feature did not enforce the Allowed HTTP Request Domains restriction configured on credentials when an MCP tool was pointed at an arbitrary URL. A member-level user with use-only access to a shared credential could send its secret to an external server they control.

In Phantom 1.3.0 and earlier, the MCP tools accepted arbitrary absolute output paths when PHANTOM_OUTPUT_DIR was unset, the default. Any caller able to send tool calls, such as an AI agent, could write or overwrite files the process user can write, including shell startup files. Separately, the stem-separation and render paths decoded input audio without a size or duration cap, so a small compressed FLAC or OGG file could expand to multi-gigabyte PCM and exhaust memory.

CVE-2026-59822 affects LiteLLM versions prior to 1.84.0. An unauthenticated attacker could send a fabricated Authorization header to the MCP Streamable HTTP endpoint, triggering an OAuth2 passthrough fallback that replaces failed key validation with an empty UserAPIKeyAuth() object. This lets requests reach MCP tooling without a valid LiteLLM key. The GitHub-assigned CVSS 4.0 base score is 8.8 (HIGH), and CWE-287 and CWE-306 are listed.

A vulnerability in the Kong Konnect Model Context Protocol (MCP) server prior to version 1.0.0 could allow a remote attacker to perform an indirect prompt injection attack and execute unintended API requests. The weakness is classified as CWE-20, Improper Input Validation, and NVD has not yet provided an assessment.

Grackle's MCP server, `@grackle-ai/mcp` with `@grackle-ai/plugin-core` and `@grackle-ai/auth`, is affected through version 0.132.1 and earlier. Authorization for scoped agent callers is enforced inline per tool and omitted in several mutating tools, such as `task_update`, `task_delete`, `task_resume`, `session_kill` and `session_resume`, so a scoped agent can act on sibling, parent or cross-workspace tasks and sessions. Backend gRPC handlers perform no caller-based authorization, making the MCP tool layer the sole boundary.

CVE-2026-54030 affects LibreChat before 0.8.5. Its MCP OAuth implementation does not check that the resource parameter from OAuth Protected Resource metadata (RFC 9728) matches the configured MCP server URL. A malicious MCP server can therefore steal access tokens meant for a legitimate server.

The `web_url_read` tool in `mcp-searxng` is vulnerable to SSRF via DNS rebinding. The `assertUrlAllowed()` function in `src/url-reader.ts` checks only the hostname string against a private address blocklist and performs no DNS resolution, so a domain that resolves to a private or loopback IP bypasses the check. In default HTTP mode, where `requireAuth` is `false`, an attacker can read arbitrary internal HTTP services reachable from the server host without authentication.

The `web_url_read` tool in mcp-searxng enforces its 5 MiB response limit only by checking the `Content-Length` header from a preliminary HEAD request. When a server omits that header, `checkContentLength()` returns `null`, the guard evaluates to `false`, and `response.text()` reads the full body with no byte cap. An unauthenticated attacker who controls or can redirect to an HTTP endpoint can force unbounded memory and CPU use, causing a Denial of Service.

agentic-flow versions <= 2.0.13 interpolated MCP tool parameters such as agent, task, name, language and agentdb arguments directly into shell command strings passed to execSync(). A malicious value can break out of the double-quoted argument and run arbitrary OS commands with the privileges of the user running the MCP server. The HTTP/SSE transports expose the same sinks without authentication or Origin/Host validation.

When @n8n/mcp-browser runs in HTTP transport mode (--transport http), its MCP endpoint accepts session initialization and tool calls with no authentication. Any network-reachable client, or any website the user visits, can open an MCP session and invoke browser-control tools. Where the n8n AI Browser Bridge extension is installed and a browser connection is active, the attacker gets navigation, JavaScript evaluation, and cookie and storage access against the user's real browser profile. The default stdio transport is not affected.

The fix for GHSA-9mqq-jqxf-grvw / CVE-2026-44336 is incomplete. Commit 68cc9427 added _resolve_rule_path() to rules.create, rules.show and rules.delete in mcp_server/adapters/cli_tools.py, but praisonai.workflow.show, praisonai.workflow.validate and praisonai.deploy.validate remain unchanged. A single unauthenticated MCP tools/call to praisonai.workflow.show can return any file the host user can read, and the dispatcher in server.py, which passes unvalidated arguments as **kwargs, is also unchanged.