Loading story…
A high-severity OAuth credential-disclosure vulnerability in Anthropic's official Model Context Protocol (MCP) Python SDK can allow a malicious HTTP MCP server to capture OAuth client secrets, authorization codes, PKCE verifiers, and ultimately valid access tokens. The attack abuses authorization-server discovery: an attacker-controlled server returns a 404 for modern discovery to trigger a legacy fallback that does not validate the issuer, then supplies malicious authorization metadata or token endpoints while presenting a legitimate identity-provider login flow to the user.
The issue affects mcp versions 1.9.1 through 1.29.1 and 2.0.0 through 2.1.1, including OAuthClientProvider, ClientCredentialsOAuthProvider, and PrivateKeyJWTOAuthProvider configurations using vulnerable OAuth providers. It is fixed in versions 1.30.0 and 2.2.0; organizations should upgrade, explicitly bind machine-to-machine or pre-provisioned credentials to the expected issuer, remove legacy stored registrations, and rotate exposed client secrets and revoke potentially compromised tokens. No CVE or confirmed exploitation had been reported.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Cycode and the MCP security advisory publicly disclosed a high-severity OAuth flaw in the MCP Python SDK. A malicious HTTP MCP server could exploit legacy discovery handling to route authorization codes, client secrets, and PKCE verifiers to attacker-controlled token infrastructure, enabling account takeover.
Anthropic released MCP Python SDK versions 1.30.0 and 2.2.0, adding expected authorization-service determination, metadata rejection for mismatched providers, and credential binding. The releases addressed OAuth discovery weaknesses affecting HTTP clients using untrusted MCP servers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers at **OX Security** disclosed a design-level weakness in Anthropic’s **Model Context Protocol (MCP)** that can allow **arbitrary OS command execution** through unsafe `STDIO` transport behavior, creating a broad AI supply-chain risk. The flaw is reported to propagate through Anthropic’s official MCP SDKs into downstream tools and agents, with researchers linking it to at least **10 high- and critical-severity vulnerabilities** across widely used projects. Reported impacts include exposure of sensitive data such as API keys, chat histories, internal databases, and developer workstations, while estimates of exposure range from more than **7,000 publicly accessible servers** to as many as **200,000 servers** potentially at risk. Affected or cited projects include **LangFlow, Flowise, GPT Researcher, Upsonic, Windsurf, Claude Code, Cursor, Gemini-CLI, GitHub Copilot, LiteLLM,** and **LettaAI**. OX Security said it began reporting the issue to Anthropic in late 2025, but Anthropic reportedly treated the behavior as expected and responded by updating security guidance rather than changing the protocol architecture. Researchers described four main abuse paths: direct command injection, hardening bypass, zero-click or near-zero-click prompt injection in AI IDEs and coding assistants, and malicious MCP marketplace submissions that can execute commands on developer machines; they urged organizations to restrict public exposure, sandbox MCP-enabled services, treat external MCP configurations as untrusted, monitor MCP tool use, and install MCP servers only from verified sources.
Jun 29, 2026
Internet-exposed Model Context Protocol (MCP) servers are frequently running without authentication, allowing anonymous users to enumerate available tools, retrieve sensitive enterprise data, and in some cases access destructive backend actions, credentials, or code-execution capabilities. Wiz found MCP deployments in 80% of surveyed cloud environments; roughly one in six environments had at least one publicly exposed server, 70% of those servers disclosed tool inventories anonymously, and 42% returned real data to unauthenticated tool calls. Many affected deployments use the pre-authentication `2024-11-05` MCP protocol version rather than releases supporting OAuth 2.1 authorization, introduced in March 2025. Organizations should inventory internet-facing MCP endpoints, restrict public exposure, require authorization before tool execution, apply least-privilege permissions to connected backend credentials, and retain agent prompt and tool-invocation logs for detection and investigation.
Sep 3, 2026
Security researchers have identified significant vulnerabilities in implementations of the Model Context Protocol (MCP), a standard developed by Anthropic to facilitate secure and standardized connections between large language models (LLMs) and external data sources or tools. One notable vulnerability involved Burp's MCP server, which exposed a localhost port without proper web origin validation, enabling DNS rebinding attacks that could turn a user's Burp installation into a remote SSRF engine. This flaw allowed attackers to hijack Burp’s MCP tools and access internal networks, and was responsibly disclosed and rewarded with a $2,000 bounty. In addition, prompt hijacking attacks have been demonstrated against MCP-based AI workflows, particularly when session ID management is insecure. Researchers from JFrog discovered that the oatpp-mcp implementation generated predictable session IDs, making it susceptible to session hijacking and prompt injection attacks. These vulnerabilities highlight the risks associated with insecure MCP server configurations and underscore the need for robust validation, session management, and defensive controls when deploying MCP in security-sensitive environments.
Jul 23, 2026