Top MCP security resources — September 2026

This time it’s easy to pinpoint the MCP security event of the month, and it isn’t a paper but a malicious campaign. Deadbugz pushed a malicious MCP server into multiple projects, shipping two innocuous tools and holding the payload back until the client had made exactly three tool calls. A reviewer checking a new server is unlikely to spot that: the metadata that turns into instructions hunting SSH keys and cloud credentials only appears once the server is trusted and in use.

The CVE side filled in the mundane half of the picture. Three MCP server flaws landed in August, and none of them is model-specific: a path traversal that hands any authenticated client arbitrary file reads, a settings tool that returns a cluster token in cleartext, and a plain SSRF. MCP servers are ordinary network services with an extraordinary caller, and they are picking up ordinary bugs. The three sit in the same classes as our ranked baseline, the Top 25 MCP vulnerabilities.

Eight resources, easy to skim. Last month’s digest covered the July 28 spec revision and the Azure DevOps confused deputy bug.

Statistics

MCP security resources

MCP vulnerability

Exposed by design: a dynamic security assessment of internet-facing MCP servers at scale

Passive discovery across eleven sources feeds an active framework of 34 test modules covering ten MCP-specific vulnerability classes. Of 640 confirmed production servers, the team audited 414, and 68 reportable vulnerabilities surfaced, including SQL injection, SSRF against cloud metadata services, prompt template injection, and path traversal via cursor manipulation. The posture numbers are worse: 91.8% had no authentication at all, and 687 tool instances exposed shell execution with no access control. The tooling has been released. Between runs, 41.6% of the servers vanished within three days.

CVE-2026-73498: path traversal in the Atlassian MCP

The confluence_upload_attachment tool passes a client-supplied file path straight to open(file_path, 'rb') with no validation. Any authenticated MCP client therefore gets an arbitrary file read primitive across everything the server process can reach, with credentials and environment variables named explicitly in the advisory. CVSS 7.7 with a changed scope, fixed in v0.22.0. It is the cleanest example this month of a tool parameter that was never treated as untrusted input.

CVE-2026-67357: ArcadeDB MCP discloses the cluster token in cleartext

A settings tool exposed over MCP returns the high-availability cluster token in cleartext, and that token is enough to impersonate root through specific headers. The result is that MCP access converts directly into full server compromise, rated CVSS 7.7 and fixed in 26.7.3. This is not a database bug that MCP happens to expose. The tool was designed to return settings, and nobody filtered its output for secrets.

CVE-2026-19956: SSRF in facebook-ads-mcp-server

Server-side request forgery in the fetch_pagination_url function lets an authenticated remote user drive requests from the MCP server’s network position. A thin record against a young project, rated medium at CVSS 5.3 and fixed in a single commit. It belongs here for the pattern: three August MCP CVEs, three classic web flaw classes, zero of them involving a model at all.

MCP defense

Securing the Oracle ORDS MCP server with Keycloak

An MCP hardening walkthrough. The MCP endpoint validates issuer, audience, JWKS signature, and a mandatory scope, and then a realm role binds to a specific database pool, so the role decides which pools the agent can see while the pool’s own credentials decide SQL privilege. The role surfaces inside the database session for row-level filtering. It is honest about the tradeoff, too: relaxing the identity provider’s client registration policies to permit MCP dynamic client registration is a demo-only move.

How Cloudflare detects MCP traffic and helps secure it

A useful detection heuristic anyone can copy: MCP rides inside ordinary encrypted traffic, but it announces itself with a protocol version header, so a network layer can fingerprint it without terminating the session. That turns shadow MCP into something you can see, so you learn which servers employees reach, and a policy can block connections that skip an approved portal.

WriteGuard: fine-grained controls for MCP servers

Every tool is classified into one of four risk tiers, from read-only through contained write to critical, and write actions are gated by a deny-by-default allow list, stamped with agent and session attribution in the destination application, and logged centrally. The tier taxonomy and the attribution requirement are the transferable parts; the implementation is a private beta, so treat the numbers around it accordingly.

MCP incident

Deadbugz: currently active MCP supply chain campaign

An active campaign distributing a malicious MCP server through public GitHub pull requests, tracked to a single account that filed 23 pull requests across unrelated AI and developer tool projects in 74 minutes. The server offers text formatting and summarization, then, after exactly three tool calls, rewrites the metadata it returns into instructions to hunt for SSH keys, AWS credentials, shell history, and Kubernetes config while concealing the activity from the user. Metadata that only turns hostile at runtime defeats review by construction. The writeup publishes IOCs: the endpoint, the local artifact path, and the repository.

The check that matters happens after approval

Deadbugz makes a one-time review structurally insufficient. A server that behaves for three calls and then changes its tool descriptions passes every check you run before approving it. So monitor tool metadata for changes after approval instead of auditing it once. If your MCP client caches tool definitions, compare them on every reconnect and alert on drift.

This again demonstrates how a modern attack is assembled from small, separate steps, each of which either looks benign or goes uninspected. The chain is the breach, and only by observing and reconstructing the whole chain of agentic actions can you stop the damage before it lands.

More general, and more important: put an authorization layer in front of your MCP servers. The Oracle walkthrough is a working template. Validate the token properly, scope it, and let a role decide which backends the agent can reach at all, so a compromised or hijacked agent inherits a narrow surface instead of the server’s full reach. Whether that layer actually holds against a hostile server is a separate question, and MCP red teaming is how you answer it.