The Model Context Protocol (MCP), introduced by Anthropic in late 2024 as a universal standard for connecting AI assistants to external tools and data sources, became a significant attack surface in 2026. Security researchers disclosed over 40 CVEs against MCP implementations, found hundreds of servers exposed to the public internet without authentication, and documented new attack classes including tool poisoning.

What is MCP

MCP provides a standardized way for AI agents to discover, invoke, and receive results from external tools. Instead of each AI provider building custom integrations for every service, MCP defines a protocol that any tool provider can implement and any AI client can consume.

The protocol prioritizes developer flexibility: agents can dynamically discover new tools, read tool descriptions, and invoke them with structured parameters. This flexibility became the security problem.

The CVE count

Between January and April 2026, researchers disclosed more than 40 CVEs against MCP implementations across Python, TypeScript, Java, and Rust SDKs (Microsoft, 2026 ).

Trend Micro found 492 MCP servers exposed to the public internet with zero authentication, offering direct access to 1,402 tools, with 90% allowing read access (Medium, citing Trend Micro 2026 ).

A 2026 audit summarized by API gateway vendor Zuplo found:

  • 40% of MCP servers require no authentication
  • 43% carry command-injection vulnerabilities
  • 79% handle credentials in plaintext

(Codersera, 2026 )

Tool poisoning

Tool poisoning emerged as the signature MCP attack. Malicious instructions are hidden in a tool’s description or schema that the model reads but the user mostly ignores.

Microsoft describes the mechanism: “Anyone who can plant instructions in any of those can steer the agent. Tool poisoning is the sharp edge - malicious instructions hidden in a tool’s description or schema that the model reads and the user mostly ignores” (Microsoft, 2026 ).

An attacker does not need to compromise the MCP server itself. They can:

  1. Create a legitimate-looking tool with a poisoned description
  2. Get the tool listed in a tool registry the agent queries
  3. The agent reads the description, follows the embedded instructions, and performs unintended actions

Vulnerable by default

AgentsID’s state-of-agent-security analysis concluded that MCP is vulnerable by default: “The protocol prioritizes developer flexibility over the schema strictness and semantic validation required for safe autonomous operation, and its own reference implementations confirm that insecurity is the path of least resistance” (AgentsID, 2025 ).

The academic paper “Model Context Protocol Threat Modeling and Analysis of Vulnerabilities to Prompt Injection with Tool Poisoning” (MDPI, 2026) documented that while MCP simplifies integration between AI applications and services, it introduces significant security vulnerabilities, particularly on the client side (MDPI, 2026 ).

Common vulnerability classes

CYFIRMA’s threat research documented the attack surface: “An AI agent operating through MCP does not connect to one external system. It connects to many. What threat actors identified, and what this report documents in detail, is that the same architectural properties that make MCP powerful make it dangerous when adversaries gain a foothold” (CYFIRMA, 2026 ).

The most common MCP vulnerabilities:

VulnerabilityImpact
No authenticationAnyone can invoke tools
Credential exposureLeaked keys, secrets in plaintext
Command injectionAttacker-controlled input reaches shell
Tool poisoningMalicious instructions in tool descriptions
Insecure transportNo TLS, traffic interception possible

Ostering’s threat model notes the mundane reality: “The most common MCP problem in the wild is mundane, not exotic: credential and token exposure (leaked keys, broad shared tokens, secrets in plaintext), not clever prompt injection” (Ostering, 2026 ).

Why it matters for builders

MCP adoption is accelerating. If you are building or consuming MCP integrations:

  1. Assume tool descriptions are untrusted input that can contain injected instructions
  2. Require authentication on all MCP servers, even internal ones
  3. Use TLS or mTLS for all MCP communication
  4. Validate and sanitize tool inputs before execution
  5. Audit which tools your agent can access and apply least privilege
  6. Monitor for anomalous tool invocations in production

The protocol’s flexibility is a feature for developers and a vulnerability for security. Until MCP matures with stricter defaults, the burden is on implementers to secure their deployments.

Update, September 2026: MCP flaws now exploited in the wild

On 2 September 2026, CISA added CVE-2026-59822 (CVSS 8.8) to its Known Exploited Vulnerabilities catalog . It is an improper-authentication flaw in the MCP Streamable HTTP endpoint of LiteLLM, the open-source AI gateway, that could let an unauthenticated attacker open an authenticated MCP session. The Hacker News reports that Wiz observed exploitation attempts against it on honeypots. A separate LiteLLM authentication-bypass chain (CVE-2026-42271 with CVE-2026-48710) was added in the same batch and has been used to deploy cryptocurrency miners. MCP implementation bugs are no longer only a research finding. Attackers are actively scanning for them.

On 10 September, Wiz research reported that 294 of 3,074 internet-facing LiteLLM gateways it scanned in February accepted the example admin key sk-1234 or had no master key set at all. That admin credential also controls the gateway’s MCP-connected tools. If you run an MCP-capable gateway, patch it, set a strong unique master key, and keep its admin interface off the public internet. The September 2026 AI agent security roundup covers these and four other disclosures from the month.

Update, October 2026: three SDK advisories

In October the MCP SDKs themselves published three advisories. The TypeScript server SDK could route one HTTP client’s responses to another when a transport or server instance was shared (GHSA-jm63-cq47-j5jp, High, fixed in @modelcontextprotocol/server 2.3.0), a pattern its own README examples had shown. The TypeScript SDK’s bearer authentication could not check a token’s audience (GHSA-rvq5-wwqv-78pq, fixed in @modelcontextprotocol/sdk 1.32.0 and @modelcontextprotocol/server 2.3.0, but only once you set expectedResource). The Python SDK’s Streamable HTTP transport never reclaimed sessions in its default stateful mode (GHSA-84m7-p3x7-pcfv, fixed in mcp 1.30.0 and 2.2.0). Minimum safe versions and the code changes are on MCP protocol ; the October 2026 agent security roundup covers them with the month’s other agent advisories.

Sources

  1. Microsoft. “The state of MCP security in 2026.” Microsoft Security Blog. https://techcommunity.microsoft.com/blog/microsoft-security-blog/the-state-of-mcp-security-in-2026/4531327
  2. MDPI. “Model Context Protocol Threat Modeling and Analysis of Vulnerabilities to Prompt Injection with Tool Poisoning.” (2026). https://www.mdpi.com/2624-800X/6/3/84/xml
  3. CYFIRMA. “Exploitation of Model Context Protocol in Agentic AI Deployments.” (2026). https://www.cyfirma.com/research/exploitation-of-model-context-protocol-in-agentic-ai-deployments/
  4. UVCyber. “Threat Advisory: MCP Threats.” https://www.uvcyber.com/resources/reports/threat-advisory-mcp-threats
  5. Codersera. “How to Secure MCP Servers (2026 Guide).” https://codersera.com/blog/how-to-secure-mcp-servers-2026/amp/
  6. AgentsID. “State of Agent Security 2026.” https://github.com/AgentsID-dev/agentsid-scanner/blob/master/docs/state-of-agent-security-2026.md
  7. The Hacker News. “CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners.” (3 September 2026). https://thehackernews.com/2026/09/cisa-adds-seven-exploited-flaws-as.html
  8. The Hacker News. “Nearly 1 in 10 Exposed LiteLLM Gateways Accepted the Example ‘sk-1234’ Admin Key.” (10 September 2026). https://thehackernews.com/2026/09/nearly-1-in-10-exposed-litellm-gateways.html
  9. MCP Python SDK maintainers, GitHub security advisory GHSA-84m7-p3x7-pcfv (CVE-2026-59951, 15 October 2026): https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-84m7-p3x7-pcfv
  10. MCP TypeScript SDK maintainers, GitHub security advisory GHSA-jm63-cq47-j5jp (CVE-2026-111770, 20 October 2026): https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-jm63-cq47-j5jp
  11. MCP TypeScript SDK maintainers, GitHub security advisory GHSA-rvq5-wwqv-78pq (CVE-2026-111771, 20 October 2026): https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-rvq5-wwqv-78pq