Model Context Protocol

LiteLLM's two MCP preview endpoints, POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list, accepted full server configurations including command, args and env for the stdio transport. Calling them with a stdio configuration spawned the supplied command as a subprocess on the proxy host with the proxy process's privileges. Because the endpoints checked only for a valid proxy API key and no role, any authenticated user, including low-privilege internal-user keys, could run arbitrary commands on the host.

Flowise is vulnerable to unauthenticated remote command execution through a parameter override bypass. The FILE-STORAGE:: check in replaceInputsWithConfig in packages/server/src/utils/index.ts uses .includes() rather than .startsWith(), so an attacker can embed the keyword in a string and skip the isParameterEnabled() check. This lets the attacker set NODE_OPTIONS through the Custom MCP node, which does not block it, and run arbitrary code with root privileges in the container. The attack requires a single HTTP request, plus API Override enabled and a public chatflow containing an MCP tool node.

mcp-server-kubernetes, a Model Context Protocol server for Kubernetes cluster management, versions 3.4.0 and prior, contains an argument injection flaw (CVE-2026-39884) in the port_forward tool in src/tools/port_forward.ts. The tool builds a kubectl command by string concatenation and splits it on spaces before calling spawn(), so spaces in namespace, resourceType, resourceName, localPort and targetPort become argument boundaries. An attacker can inject arbitrary kubectl flags, such as --address=0.0.0.0 to expose internal Kubernetes services to the network or additional -n flags to target other namespaces, including through prompt injection against connected AI agents.

CVE-2025-61260 affects OpenAI Codex CLI v0.23.0 and earlier. A malicious or compromised repository can trigger code execution when a user runs the codex command inside it, because Codex automatically loads project-local .env and .codex/config.toml files, including malicious MCP (Model Context Protocol) configuration, without user confirmation. Attackers can embed arbitrary commands that execute immediately.

The java-sdk MCP server contained a DNS rebinding vulnerability because it performed no Origin header validation before version 1.0.0, contrary to the MCP specification. An attacker can use a malicious website opened in a victim's browser to make arbitrary tool calls to a locally or privately networked MCP server, acting as a locally connected AI agent. Servers built on frameworks with built-in Origin validation, such as Spring AI, are not affected.

The mobile_open_url tool in @mobilenext/mobile-mcp passes user-supplied URLs straight to Android's intent system through adb shell am start without scheme validation. Because MCP servers are driven by AI agents that can be manipulated through prompt injection, a malicious document or website could make the agent open tel:, sms:, mailto:, content:// or market:// URLs, enabling USSD codes, calls, SMS drafts, content provider access and app installation prompts.

The Model Context Protocol (MCP) Go SDK does not enable DNS rebinding protection by default for HTTP-based servers. A malicious website could use DNS rebinding to bypass same-origin restrictions and send requests to an HTTP-based MCP server running on localhost without authentication, using `StreamableHTTPHandler` or `SSEHandler`. This could let an attacker invoke tools or access resources on the user's behalf, and servers using stdio transport are not affected.

The FastMCP OAuthProxy does not verify user consent when it receives an authorization code from the identity provider, in its _handle_idp_callback function. Because GitHub skips the consent page for previously authorized clients, an attacker can capture a GitHub authorization URL after consenting and lure a logged-in victim to open it. The victim's browser then redirects to the malicious client's callback with a valid authorization code, which the attacker can exchange for an access token to the benign MCP server tied to the victim's GitHub account. The issue was verified only for GitHubProvider, but the flaw affects any OAuth integration whose identity provider skips consent.

FastGPT, an AI Agent building platform, has an SSRF flaw in its MCP tools endpoints, /api/core/app/mcpTools/getTools and /api/core/app/mcpTools/runTool, before version 4.14.9.5. These endpoints accept a user-supplied URL and send server-side HTTP requests to it without checking for internal or private network addresses. The application's isInternalAddress() function exists but these endpoints do not call it. An authenticated attacker can scan internal networks, reach cloud metadata services, and interact with internal services such as MongoDB and Redis.

adx-mcp-server, at latest and commit 48b2933, contains KQL injection in three MCP tool handlers: get_table_schema, sample_table_data and get_table_details. The table_name parameter is interpolated into KQL via f-strings with no validation, so a caller or a prompt-injected agent can run arbitrary KQL against the Azure Data Explorer cluster, including reading other tables and issuing management commands such as .drop table. The flaw bypasses client trust boundaries because these tools are presented as safe metadata tools.

The knowledge_search and knowledge_get_node MCP tools in @grackle-ai/mcp are listed in SCOPED_TOOLS, so scoped agents can call them, but their handlers do not receive authContext or enforce workspace scoping. A scoped agent in Workspace A can pass an arbitrary workspaceId to read knowledge graph data from Workspace B, bypassing workspace isolation (CWE-284).