tag
Mcp
AI Engine WordPress Plugin Unauthenticated MCP Token Disclosure to Admin Account Creation (CVE-2025-11749)
AI Engine's built-in Model Context Protocol (MCP) server, exposed via WordPress REST routes under /wp-json/mcp/v1/, discloses a per-site MCP access token directly in the unauthenticated route listing when the plugin's MCP feature (or a "No-Auth URL"-style…
Sliver C2 MCP Server Unauthenticated CORS/Preflight Bypass (CVE-2026-34227)
Sliver's MCP server exposes an unauthenticated Server-Sent Events (SSE) interface on 127.0.0.1:8080 and responds to every request with Access-Control-Allow-Origin: . Because the underlying mcp-go library does not validate the request's Content-Type, a…
Nhost Local MCP Server Unauthenticated CORS Bypass Leading to Full Project Takeover (CVE-2026-34200)
The Nhost CLI's local MCP server, used to let AI agents/tools manage a developer's Nhost project, has no inbound authentication and inherits a permissive Access-Control-Allow-Origin: CORS policy from the underlying mcp-go library. Because the server does not…
MCPJam Inspector Unauthenticated Command Injection RCE (CVE-2026-23744)
This repository is a German-language Hack The Box "DevHub" walkthrough that documents a full attack chain, one step of which is a genuine, directly reusable RCE against MCPJam Inspector v1.4.2 (CVE-2026-23744). The vulnerable /api/mcp/connect endpoint accepts…
MCPJam Inspector / Arcane MCP Connect Command Injection RCE via Host-Header Vhost Routing (CVE-2026-23520)
The Model Context Protocol (MCP) connect endpoint /api/mcp/connect accepts a JSON body describing a new server connection, including a command and args array that get executed on the host without sanitization. In many deployments the vulnerable component sits…
mcp-atlassian Path Traversal via confluence_upload_attachment (CVE-2026-27825)
The confluenceuploadattachment MCP tool in mcp-atlassian passes its filepath argument straight into open(filepath, "rb") with no path validation, letting an attacker read arbitrary files on the server's filesystem and exfiltrate them via a multipart upload to…
local-mcp exec Tool Sandbox/Restriction Bypass (CVE-2026-6130)
This is not a standalone PoC script but the actual local-mcp MCP server codebase, whose exec tool contains the real CVE-2026-6130 bypass: a workaround using a generated batch file plus base64 encoding that circumvents intended command-execution restrictions…
graphiti-core Cypher Injection via Unsanitized node_labels — CVE-2026-32247
graphiti-core builds Cypher WHERE clauses for its searchnodes functionality by joining caller-supplied node label strings with | and concatenating the result directly into a raw query string, with no parameterization or input validation anywhere in the call…
adx-mcp-server KQL Injection via table_name Parameter (CVE-2026-33980)
adx-mcp-server is a Model Context Protocol server that exposes tools letting an AI agent query an Azure Data Explorer (Kusto/KQL) cluster. Three "safe" metadata tools — gettableschema, sampletabledata, and gettabledetails — build their KQL queries by directly…
Flowise Custom MCP Environment Variable Case Bypass
Flowise's Custom MCP stdio node validates configured environment variables against a denylist (PATH, LDLIBRARYPATH, DYLDLIBRARYPATH, NODEOPTIONS) using exact, case-sensitive string comparison. Windows, however, treats environment variable names…
Authenticated Command Injection in LiteLLM MCP Test Endpoints (CVE-2026-42271)
CVE-2026-42271 is a command injection vulnerability in BerriAI LiteLLM's MCP preview/test endpoints — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list. These endpoints accept a full MCP server configuration in the request body, including…