Model Context Protocol

Network-AI v5.4.4 defaults the MCP SSE server secret to an empty string (`process.env['NETWORK_AI_MCP_SECRET'] ?? ''` in `bin/mcp-server.ts`), so `_isAuthorized` in `lib/mcp-transport-sse.ts` returns true for every request with no Authorization header. The server also sends `Access-Control-Allow-Origin: *` on every response, letting a cross-origin browser script read results. An attacker who lures a user to a malicious web page can invoke all 22 exposed MCP tools, including `config_set`, `agent_spawn` and `blackboard_write`, against a default-configured localhost server.

The mcp-server-kubernetes package exposes ALLOW_ONLY_READONLY_TOOLS, ALLOW_ONLY_NON_DESTRUCTIVE_TOOLS and ALLOWED_TOOLS as access controls, but they are enforced only at tools/list and not at tools/call. Any client that knows a tool name can invoke it directly, so kubectl_delete, exec_in_pod, kubectl_generic and node_management run regardless of the configured restriction, which the advisory says is equivalent to full cluster compromise when the service account has cluster-admin.

The PenPot MCP module's ReplServer binds to 0.0.0.0:4403 and exposes an unauthenticated /execute endpoint that runs arbitrary JavaScript posted in a JSON code field. The earlier fix for the similar binding issue in #8683 covered PenpotMcpServer.ts but missed ReplServer.ts, which still calls listen(this.port) with no host argument. The reporter demonstrated file reads, command execution and environment variable dumps from another container on the same Docker network.

The download_media and auth_fetch tools in ymw0407/auth-fetch-mcp accept arbitrary URLs and request them from the MCP server process without validating the destination. An MCP client can therefore reach loopback, link-local and private-range hosts, and download_media additionally writes the response body to a user-controlled output directory.

When ENABLE_MULTI_TENANT=true, n8n-mcp's HTTP transport selects the target n8n instance from the x-n8n-url and x-n8n-key headers, but requests missing one or both headers silently fell back to the operator's process-level N8N_API_URL and N8N_API_KEY. An authenticated MCP tenant could therefore run n8n management calls against the operator's own instance, with possible escalation to remote code execution where Code-node execution reaches OS-level modules. Single-tenant deployments are not affected.

Flowise's MCP feature contains a security bypass chain that lets an attacker run arbitrary commands on the host. The validateCommandFlags blocklist in packages/components/nodes/tools/MCP/core.ts omits docker build, so a Custom MCP Server configured as docker build <remote-URL> pulls and runs a remote Dockerfile. A second bypass uses the long alias --yes, which is not blocked for npx, letting npx install and execute an attacker-supplied npm package. The attacker needs a Flowise account of any role or an API key with view and update permissions for chatflows, and the server must have the docker or npx command available.

CVE-2026-43989 affects JunoClaw, an agentic AI platform built on Juno Network, prior to 0.x.y-security-1. The upload_wasm MCP tool accepted a filesystem path from the agent and uploaded whatever bytes that path resolved to, without validating location, symlink target, file size, or file format. The flaw is classified as CWE-20, CWE-22, CWE-59 and CWE-73.

n8n-mcp versions before 2.50.1 contain three independently reported issues in deployments that use the n8n API integration. An authenticated MCP caller can supply crafted identifiers that the n8n API client uses as URL path segments, sending the configured n8n API key to other same-origin endpoints and bypassing handler-level controls including DISABLED_TOOLS. Validated webhook, form and chat trigger URLs also follow redirects, returning the response body to the caller, and default opt-in telemetry uploads unredacted operation payloads that can contain bearer tokens, API keys and webhook secrets. CVSS 8.3 (HIGH); exploitation requires an authenticated MCP caller and a configured n8n API key.

Authenticated server-side request forgery in n8n-mcp affects the webhook trigger tools, the n8n API client via N8N_API_URL, and per-request URLs supplied in the x-n8n-url header in multi-tenant HTTP mode. A caller with an MCP session can make the n8n-mcp host send requests to internal services and cloud metadata endpoints, and the response body is returned to the caller. Fixed in n8n-mcp@2.50.2.

Prior to version 1.4.0, the rmcp crate's Streamable HTTP server transport did not validate the incoming Host header, so a malicious public website using a DNS rebinding attack could send authenticated requests to a local or private-network MCP server. An attacker could enumerate and invoke exposed tools and read resources, and because MCP servers often run with the user's privileges, the impact can extend to arbitrary code execution on the victim's machine.

Network-AI version 5.1.2 (commit c344f2053eb0d49395988f803bf92f2a86b2a0d0) accepts JSON-RPC tools/call requests on its MCP HTTP transport with no authentication, session, origin or token check, dispatching them straight to the orchestrator's tool registry. The default bind address is 0.0.0.0, so any party with network reachability can list and invoke privileged tools such as config_get and config_set, agent_spawn, token_create and budget_set_ceiling. The advisory is rated High (CWE-306) and was validated on 2026-04-21 with a proof of concept that changed a live configuration value without credentials.

An unauthenticated attacker can register a malicious MCP OAuth client with a crafted client_name. When a second user revokes access after a victim authorized the OAuth consent dialog, a toast notification renders the injected script. Clicking the link runs arbitrary JavaScript in the victim's authenticated n8n browser session, enabling credential and session token theft, workflow manipulation, or privilege escalation.

The MCP OAuth client registration endpoint in n8n accepted unauthenticated requests and stored client data without adequate resource controls. A remote attacker can exhaust server memory with large registration payloads, making the instance unavailable, and the endpoint remains reachable even when MCP is disabled.