Model Context Protocol

A flaw in claude-code-action combined checking out attacker-controlled PR head branches, reading `.mcp.json` from the working directory through default setting sources, and unconditionally enabling all project MCP servers via `enableAllProjectMcpServers`. An attacker who opens a PR containing a malicious `.mcp.json` can achieve arbitrary code execution on the GitHub Actions runner. This can expose workflow secrets such as API keys and tokens when a privileged user or automatic trigger runs the action on that PR.

The kubectl_generic tool in mcp-server-kubernetes passes user-supplied flags and args straight to kubectl with no allowlist. An attacker with limited access can plant a JSON log line that an AI agent follows, causing kubectl to send the operator's Authorization: Bearer token to an attacker endpoint via --server and --insecure-skip-tls-verify=true. The captured token can then be replayed against the real Kubernetes API server, granting the operator's service account RBAC permissions.

Researchers at Mitiga Labs published an attack chain in which a malicious npm package's post-install hook rewrites ~/.claude.json, redirecting Claude Code's MCP traffic to attacker-controlled infrastructure and intercepting the OAuth bearer tokens stored there in plaintext. Mitiga reported the issue to Anthropic on April 10, and Anthropic replied on April 12 that it was out of scope; the article states no patch exists as of writing. It also recalls two earlier Claude Code flaws, CVE-2025-59536 and CVE-2026-21852, disclosed by Check Point Research in February 2026 and patched by Anthropic.

In LibreChat versions up to and including 0.8.3, users with only VIEW access to an MCP server can retrieve the server's decrypted admin-managed secrets through GET /api/mcp/servers and GET /api/mcp/servers/:serverName. The returned config includes plaintext apiKey.key and oauth.client_secret values, letting viewers of a shared MCP server exfiltrate the underlying provider credentials.

Researchers at Obsidian Security disclosed CVE-2026-40933, a one-click remote code execution flaw in self-hosted Flowise deployments through its implementation of MCP stdio servers. Flowise lets users configure stdio servers with arbitrary commands, which the operating system then runs with the Flowise process's privileges, and a malicious chatflow import can trigger this before any save or run. The flaw is rated 9.9 CVSS, and Flowise Cloud is not affected because stdio MCP is disabled there.

Permiso Security disclosed ChatGPhish, a technique in which a web page that a user asks ChatGPT to summarize can cause the chatgpt.com response renderer to display attacker-controlled Markdown links, image URLs, fake security alerts and QR codes as live elements in the assistant's UI. The renderer auto-fetches attacker-hosted images, which can leak the victim's IP, User-Agent and Referer. Separately, Adversa AI documented SymJack and TrustFall, which target AI coding agents and can lead to code execution through malicious repositories and MCP servers.

A single malformed character in the Host header lets an unauthenticated attacker bypass host-validation protections in Starlette, the Python framework underlying FastAPI, tracked as CVE-2026-48710. Starlette rebuilds the request URL by joining the Host header to the path, and a slash, question mark or hash in the Host header shifts where the path begins, so middleware reads a different path than the one routed. Researchers at X41 D-Sec rated the flaw 7.0 (High), while Starlette's maintainer rated it 6.5 (Moderate), and they said downstream applications built on FastAPI, including AI model-serving tools, gateways and MCP servers, can be affected.

Adversa AI describes SymJack, an attack that uses a malicious repository to turn AI coding agents into delivery mechanisms for supply chain attacks. A malicious symlink, renamed to look innocuous, is used with a cp command to plant a payload in the agent's configuration, registering a malicious MCP server whose startup command runs attacker code as the user on the next restart. Adversa reports the method worked in all five coding agents it tested, including Claude Code, Gemini CLI, Cursor Agent CLI, Grok Build CLI and GitHub's Copilot CLI.