← Notes & write-ups

Aimed at the wrong bug: 36 MCP advisories, and not one of them is AI-native

28 October 2026· 6 min read

The one critical vulnerability in the official Model Context Protocol tooling this year was not a clever prompt. It was a proxy with no lock on the door. CVE-2025-49596 scored 9.4 out of 10, and its mechanism fits in a sentence: versions of @modelcontextprotocol/inspector before 0.14.1 let an unauthenticated request start MCP commands over stdio, so any web page the victim had open could reach the local debugging proxy and run code on their machine. Missing authentication for a critical function, CWE-306. That weakness is older than I am.

Almost everything written about securing AI agents in 2026 is about the model: prompt injection, tool poisoning, a document that smuggles instructions into the context window. That work is real and I am not waving it away. But the Inspector bug made me want to check a smaller, duller question against the public record. Of the vulnerabilities actually filed against the official MCP code, how many are AI-native, meaning they exist only because a language model is in the loop, and how many are the ordinary infrastructure bugs we were already writing advisories about ten years ago?

So I built the smallest lab that could answer it. One script asks the public GitHub Advisory Database for every reviewed advisory affecting the first-party MCP packages: the Python SDK mcp, the TypeScript SDK @modelcontextprotocol/sdk, the go-sdk, the Rust SDK rmcp, the @modelcontextprotocol/inspector debugging tool, and two reference servers, @modelcontextprotocol/server-filesystem and mcp-server-git. A second script reads the CWE weakness tags on each advisory and sorts the set into AI-native against classic. No tarballs, no login, about ninety kilobytes of JSON. Every number in this post falls out of that one query, run on 28 October 2026.

Thirty-six unique advisories came back. Zero are AI-native. All thirty-six are classic infrastructure or web bugs, spread across twenty-nine distinct weakness types.

A grid of 36 dots, one per advisory, all coloured as classic bugs and none as AI-native
Every advisory filed against the official MCP packages, one dot each. The count of AI-native weaknesses, prompt injection and the rest, is zero.

Reading the list feels like reading a web-application pentest from 2012. @modelcontextprotocol/server-filesystem had a path-traversal bug (CVE-2025-53110) where a colliding path prefix walked a file tool outside its allowed directory. The rmcp streamable-HTTP transport accepted requests without checking the Origin header, a textbook DNS-rebinding hole (CVE-2026-42559), and separately let an unauthenticated caller pile up the session table until the server ran out of memory (CVE-2026-63128). The Python SDK's WebSocket transport did no Host or Origin validation at all (CVE-2026-59950). The TypeScript SDK accepted bearer tokens that had been issued for a different service (CVE-2026-111771), the audience-validation mistake OAuth has been warning about for a decade. Group them by weakness and the shape is plain.

Weakness familyCWE hitsWhat it is
Origin / DNS rebinding / CSRF12A server that trusts any site able to reach it, so a page in your browser drives your local agent
Resource exhaustion / DoS11Unbounded sessions, memory or connections a stranger can stack up until the server falls over
Authentication / authorization8Functions with no login, or tokens accepted that were issued for someone else
Path traversal / link following5A file tool talked into reading or writing outside the folder it was handed
Input parsing / case / race5Malformed input, case tricks or timing windows that confuse the parser
Injection (command / code / XSS)4Untrusted text reaching a shell, an eval, or a browser as code
Information exposure3Internal data leaking out through errors or responses
SSRF2The server tricked into fetching internal addresses on the attacker's behalf

The counts are CWE occurrences, so they add to more than thirty-six: one advisory often carries two or three tags. The ranking is the point. Origin-trust and denial-of-service alone account for more than half of everything catalogued.

A bar chart of the 36 MCP advisories grouped by weakness family, every bar a classic infrastructure or web bug
The same 36 advisories by weakness. The tall bars are the oldest problems in the book; the AI-native column does not exist.

The clearest confirmation came from the project's own homework. The MCP security best-practices document is careful and thorough, and when you list what it actually warns about, the items are confused-deputy OAuth proxies, token passthrough, SSRF against cloud metadata endpoints, DNS rebinding onto localhost, javascript: URLs that become XSS and then remote code execution, guessable session handles, mix-up attacks between authorization servers. Every one is an OAuth or web-infrastructure problem. The protocol's written threat model is a web threat model, and the model in the loop barely appears in it.

A clean zero should make you suspicious, and it made me suspicious of my own script. The honest objection is that a catalogue like this only counts what gets filed, and a prompt-injection flaw rarely gets filed as a CVE against library code. It lives in how a model behaves, or in how one particular server wires its tools together, not in a function someone can patch and tag with a version number. So a zero here does not mean prompt injection is rare in the wild. It means the SDK bugs serious enough to earn an advisory are, so far, all plumbing.

That pushed me to look at the layer where real deployments live, and the one measurement study I could find there points the same way. Zhou and colleagues scanned 7,973 live remote MCP servers in May 2026. They found 40.55 per cent exposing tools with no authentication at all, and of the 119 OAuth-protected servers they could test, every single one had at least one flaw, 325 between them. The place you would expect AI-native danger turns out to be bleeding from the oldest wound there is: nobody checked for a password.

I should say plainly where this could be wrong. I picked seven packages, and I picked the official ones, which are exactly the projects disciplined enough to write advisories in the first place; a sweep across the thousands of third-party servers would read differently. The AI-native label is my own mapping onto the CWE list, and it leans conservative, so a prompt-injection bug tagged with a generic input-validation CWE lands in my classic pile by default. And I spent most of a day convinced my collector was broken, re-running it against single packages, because I did not believe the AI-native count could really be zero, before I accepted that the script was just telling me what was there.

None of this says the model is safe to ignore. It says the bill came due on the boring parts first. Before asking whether an agent can be talked into something clever, it is worth asking whether the thing it connects to checks who is calling. For the one critical vulnerability in the entire official MCP surface this year, the answer was no.

Sources / Nguồn:
- Method and code: github.com/daihongphucecq/mcp-advisory-shape — 36 advisories across 7 official MCP packages, collected 28 October 2026 from the public GitHub Advisory Database.
- GitHub Advisory Database (the source queried): github.com/advisories
- The MCP Inspector critical, CVE-2025-49596 / GHSA-7f8r-222p-6f5g, CWE-306, CVSS 9.4: github.com/advisories/GHSA-7f8r-222p-6f5g
- MCP Security Best Practices (the protocol's own threat model): modelcontextprotocol.io
- Zhou, Zhang, Zhang, Zhang, Zhang, Yang — "A First Measurement Study on Authentication Security in Real-World Remote MCP Servers", arXiv:2605.22333, 21 May 2026: arxiv.org/abs/2605.22333
- My previous write-up, same method on a different ecosystem: dhf.io.vn

PreviousSpeed is not the signal: 29,824 npm publish timestamps and the field an