The vulnerability of the MCP-server for integrating AI-assisted assistants, such as Slack Model Context Protocol, arises from insufficient validation of input data. This allows attackers to disclose protected information.

🗓️ 20 Oct 2025 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 2 Views

Model context protocol server for AI assistants has input validation flaws enabling data disclosure.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2025-34072	2 Jul 202515:31	–	circl
CNNVD	Anthropic Slack Model Context Protocol Server 安全漏洞	2 Jul 202500:00	–	cnnvd
CVE	CVE-2025-34072	2 Jul 202513:46	–	cve
Cvelist	CVE-2025-34072 Anthropic Slack MCP Server Data Exfiltration via Link Unfurling	2 Jul 202513:46	–	cvelist
EUVD	EUVD-2025-19718	3 Oct 202520:07	–	euvd
NVD	CVE-2025-34072	2 Jul 202514:15	–	nvd
Positive Technologies	PT-2025-27630 · Anthropic · Slack Model Context Protocol (Mcp) Server	2 Jul 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-34072	4 Jul 202514:22	–	redhatcve
Snyk	Improper Neutralization of Input Used for LLM Prompting	2 Jul 202514:41	–	snyk
vulnersOsv	@flinkhouse/servers (=0.6.2), @iflow-mcp/leadfarmer-ai-mcp-server-example (>=1.0.0 <=1.0.2) +9 more potentially affected by CVE-2025-34072 via @modelcontextprotocol/server-slack (=2025.4.25)	2 Jul 202514:41	–	vulnersosv

Source	Link
embracethered	www.embracethered.com/blog/posts/2025/security-advisory-anthropic-slack-mcp-server-data-leakage/
vulncheck	www.vulncheck.com/advisories/anthropic-slack-mcp-server-data-exfiltration
github	www.github.com/modelcontextprotocol/servers-archived/blob/main/SECURITY.md
web	www.web.nvd.nist.gov/view/vuln/detail

20 Oct 2025 00:00Current

5.7Medium risk

Vulners AI Score5.7

CVSS 27.8

CVSS 38.6

EPSS0.00371

model context protocol ai assistants input validation flaws data disclosure remote data disclosure