Top MCP security resources — November 2026

A web page could read every secret in a developer’s environment through the MCP reference server: @modelcontextprotocol/server-everything paired wildcard CORS and no authentication with a get-env tool that returned all of process.env. In the MCP TypeScript server SDK, shared transports could deliver one HTTP client’s messages to another, and FastMCP’s OAuth client wrappers would send a client secret to whatever authorization server an untrusted MCP server advertised. These flaws fit classes in our ranked baseline, the Top 25 MCP vulnerabilities, each paired with the mitigation that closes it.

October’s papers added numbers. A study of 21,097 MCP servers ended in 13 security advisories, including two CVEs in Anthropic’s Git MCP Server. A logging attack hidden in poisoned tool descriptions reached attack success rates of 62.64 to 100%, while target task completion barely moved in 16 of 18 tested pairs.

Nine resources follow, grouped by topic. Last month’s digest covered LiteLLM’s MCP auth bypass joining CISA’s KEV list.

Statistics

Total resources: 9

MCP security resources

MCP vulnerability

agent-router: MCP session resume does not verify the embedded anti-hijacking subject; default Helm seed makes session IDs forgeable

The MCP proxy in Envoy AI Gateway embeds the caller’s JWT subject in each session ID to prevent hijacking, then discards it on resume without comparing it to the current caller. The official Helm chart also ships a publicly known default seed, “default-insecure-seed”, for the key that encrypts those IDs, so an attacker can forge another user’s Mcp-Session-Id rather than only reuse a stolen one, then read state and call tools in that user’s backend session. Multi-tenant deployments should move to 1.2.0-rc1 and check which seed they run; the TypeScript SDK flaw below breaks the same boundary between users by a different route.

Cross-origin environment variable exfiltration in @modelcontextprotocol/server-everything

The HTTP transports of this MCP reference server bind to all interfaces with wildcard CORS and no authentication, and its get-env tool returns the entire process environment to any caller. Any web page open in the developer’s browser can complete the MCP handshake cross origin and collect API keys and database credentials with no user interaction. The advisory’s attack chain reaches the server at localhost, so a server never exposed to the network is still in range of a browser tab; the fix is in 2.0.1.

DNS rebinding lets a web page find, exfiltrate, and delete private notes via the unauthenticated MCP SSE transport, bypassing the documented localhost mitigation

Basic Memory told operators to bind its unauthenticated SSE transport to localhost, but DNS rebinding reaches the server there anyway because the missing control is Host and Origin validation, not the bind address. Its FastMCP dependency ships a guard for exactly this, HostOriginGuardMiddleware, but the guard is off by default and Basic Memory never enabled it, so a visited web page could drive the full tool surface. This is the same path from browser to local server as the server-everything flaw above; upgrade to 0.24.0 and check whether other HTTP servers you run on FastMCP turn the guard on.

fastmcp MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server

ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider in FastMCP neither accept nor forward an issuer, so the client trusts whichever authorization server an MCP server advertises. A malicious or compromised MCP server can point the client at its own authorization server and receive the client secret or a signed assertion, which can allow impersonation against the legitimate server for applications that connect to untrusted MCP URLs. Upgrading to 4.1.2 is not enough on its own: you also have to set the new issuer parameter and rotate reusable credentials that may already have reached an untrusted endpoint.

MCP TypeScript server SDK: shared transport or server instances delivered one HTTP client’s messages to another

@modelcontextprotocol/server 2.0.0 through 2.2.0 matched messages to connections by JSON-RPC id alone, and because SDK clients number requests from 0, those ids collide in normal use. An HTTP server that created one transport or server at startup could deliver one client’s responses and notifications to another, and until this release the README examples for the Hono, Express, Fastify and Node packages showed that pattern. Version 2.3.0 refuses to be shared, so affected apps fail requests after upgrading until the code builds a server per request or per session; stdio servers are not affected.

MCP defense

Agentic AI defense: decode-time provenance binding for MCP

Instructions hidden in an email signature image through LSB, DCT, or metadata steganography pass text scanners and enter a multi-agent workflow once a tool decodes them, a move the paper calls “cross-modal trust laundering”. On a real MCP testbed with 24 adaptive payloads, the undefended pipeline had 100% attack success and keyword and regex defenses each let 62.5% through, while trust labels authenticated with HMAC, a provenance ledger, and context taint tracking blocked all of them. The result holds within fully mediated MCP execution environments, so every critical tool call has to pass through the enforcement point for this to apply.

MCP tool exposure is a privilege grant: a two-gate authorization model for agentic AI

A Cloud Security Alliance article argues that placing a tool in front of an agent expands its operational privilege surface even before any backend authorization, so capability admission and execution authorization should be separate gates. Tool shape decides much of the risk: restartApprovedService(serviceId) keeps sensitive logic in deterministic code, while executeCommand(command) hands the model a generic execution primitive. The filesystem capability laundering results further down show what follows when a tool’s real reach exceeds its declared contract.

Attack technique

Log-To-Leak: prompt injection attacks on tool-using LLM agents via the Model Context Protocol

Poisoned MCP tool descriptions induce a separate logging call that the attacker controls after the final legitimate call, carrying the user query, server name, server response, and agent response. Across 18 model and server pairs, attack success ranged from 62.64 to 100%, and in 16 pairs target task completion changed by at most 6.63 percentage points, so a task that looks finished says nothing about whether data left. Three evaluated defenses left residual success above 55% on GitHub MCP with GPT-4o and an instruction detector flagged 85.53% of benign descriptions, which is why the paper calls for host authorization of secondary tool calls, close to the second gate in the model above.

MCP red teaming

My credentials, please: detecting filesystem capability laundering in MCP servers at scale

In typical local deployments, approving an MCP tool call grants the server process broad host filesystem permissions, so arguments an attacker steers can reach sensitive files outside the tool’s declared contract. Across 21,097 servers from nine registries, the MCP-FSD tool found that 787 of 4,806 triaged servers (16.4%) had filesystem capabilities despite non-filesystem classifications, and dynamic validation confirmed 150 vulnerable instances under tested sandbox policies. Coordinated disclosure produced 13 security advisories, including two CVEs in Anthropic’s Git MCP Server, so a server’s functional category tells you little about what it can read.

Audit what your MCP servers can reach this week

Stop counting localhost as a security boundary. Two of these advisories reached local servers from an ordinary browser tab, so check every HTTP or SSE MCP server for authentication, a CORS allowlist, and Host and Origin validation, then rotate whatever was sitting in the environment of an affected server-everything install.

Check the upgrades that need more than a version bump. FastMCP 4.1.2 protects you only after you set issuer, and @modelcontextprotocol/server 2.3.0 breaks apps until each request or session gets its own server. If several users share one MCP endpoint, those shared instances and the agent-router session path are where to look first.

Then move enforcement off text inspection. Keyword and regex defenses let 62.5% of steganographic payloads through, and three tested defenses left the logging attack above 55%, so put authorization on tool calls at the host, narrow generic tools to specific ones, and sandbox the filesystem access each server actually needs. Whether those layers hold against a hostile server is what MCP red teaming tests.