Loading story…
A high-severity vulnerability tracked as CVE-2026-67431 affects the official Model Context Protocol (MCP) Ruby SDK, allowing attackers to hijack active sessions and execute unauthorized JSON-RPC tools/call requests. The flaw exists in MCP::Server::Transports::StreamableHTTPTransport in the mcp gem before version 0.23.0, where the server verifies only that a session exists and does not bind the session ID to the legitimate owner. If an attacker obtains a valid Mcp-Session-Id, requests can be routed into the victim’s session with impacts including unauthorized tool execution, integrity loss, and limited availability disruption.
Reports say exploitation depends on theft of active session identifiers rather than guessing them, with likely exposure paths including insecure logging, unencrypted local loopback traffic, and side channels on shared systems. An attacker can then submit crafted HTTP POST requests carrying the stolen session header to trigger backend capabilities such as file access or command execution, and can also send notifications/cancelled messages to interrupt a victim’s operations. The issue is classified as CWE-284 and has been fixed in Ruby SDK version 0.23.0, which adds stronger request validation including origin checks and an optional session_request_validator callback to better bind requests to the correct session owner.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
The official MCP Ruby SDK fixed CVE-2026-67431 in version 0.23.0, addressing improper access control in StreamableHTTPTransport that allowed requests using a stolen session ID to execute in a victim's session. The update added protections including origin validation and an optional session_request_validator callback to better bind requests to the legitimate session owner.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvereports.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity OAuth credential-disclosure vulnerability in Anthropic's official Model Context Protocol (MCP) Python SDK can allow a malicious HTTP MCP server to capture OAuth client secrets, authorization codes, PKCE verifiers, and ultimately valid access tokens. The attack abuses authorization-server discovery: an attacker-controlled server returns a `404` for modern discovery to trigger a legacy fallback that does not validate the issuer, then supplies malicious authorization metadata or token endpoints while presenting a legitimate identity-provider login flow to the user. The issue affects `mcp` versions 1.9.1 through 1.29.1 and 2.0.0 through 2.1.1, including `OAuthClientProvider`, `ClientCredentialsOAuthProvider`, and `PrivateKeyJWTOAuthProvider` configurations using vulnerable OAuth providers. It is fixed in versions 1.30.0 and 2.2.0; organizations should upgrade, explicitly bind machine-to-machine or pre-provisioned credentials to the expected issuer, remove legacy stored registrations, and rotate exposed client secrets and revoke potentially compromised tokens. No CVE or confirmed exploitation had been reported.
Sep 30, 2026
Two newly disclosed vulnerabilities affected software built around the **Model Context Protocol (MCP)**, highlighting security weaknesses in AI-agent tooling. **CVE-2026-63119** impacts the MCP Ruby SDK distributed as the `mcp` gem before version `0.23.0`, where unbounded reads from stdio streams can let a connected peer or spawned subprocess send newline-free data until memory is exhausted, causing denial of service. Separately, **CVE-2026-54785** affects the `gemini-bridge` MCP server's file-handling logic, where improper path validation in `_resolve_path` allows directory traversal and local file disclosure outside the configured workspace, potentially exposing sensitive files through Gemini query responses. The disclosures come as MCP adoption expands and security guidance around AI-agent integrations matures. The MCP specification and introduction describe the protocol as a standard way to connect models with external tools and data sources, while recent security research has warned that tool-calling systems introduce risks including prompt injection, excessive privilege, SSRF, and data leakage. In parallel, the OpenID Foundation published draft **COAZ** and **COAZ-MCP** specifications to bring standardized authorization to MCP message flows before tool execution, and practitioner research on MCP deployments has emphasized authentication, input validation, logging, and least-privilege design as necessary safeguards for enterprise use.
Aug 1, 2026
Researchers disclosed multiple security flaws affecting AWS MCP components, including a local file inclusion bug in the AWS Remote MCP Server and a critical command injection issue in `aws-mcp-server`. Varonis said authenticated users could abuse AWS CLI shorthand syntax, specifically the `@=` operator passed through the `aws___call_aws` tool, to read arbitrary files from the underlying host even when `FileAccessMode=NO_ACCESS` was enabled. AWS assigned **CVE-2026-4270** to the file access restriction bypass and said the issue was fixed in `aws-api-mcp-server` version **1.3.9**; the exposure affected the public endpoint `aws-mcp.us-east-1.api.aws` as well as self-hosted or forked deployments. A separate flaw, tracked as **CVE-2026-5058** and published by Trend Micro's Zero Day Initiative as **ZDI-26-246**, allows unauthenticated remote code execution in `aws-mcp-server` because user-supplied input in the allowed-commands list is not properly validated before being used in a system call. ZDI rated the bug **CVSS 9.8** and said successful exploitation lets attackers run arbitrary code in the MCP server context; the advisory was released as a 0-day after the vendor rejected the report. The disclosures landed alongside another AWS bulletin for **CVE-2026-4269**, an improper S3 ownership verification issue in the Bedrock AgentCore Starter Toolkit, underscoring broader security concerns around MCP-related tooling and the need for immediate patching and review of derivative implementations.
Jun 29, 2026