CVE-2025-6514

mcp-remote 将仅支持本地（stdio）服务器的 MCP 客户端连接到远程 MCP 服务器，并支持身份验证： 注意：这是一个可用的概念验证 ，但应被视为实验性 。 为什么需要它？ 到目前为止，大多数 MCP 服务器都通过 stdio 传输在本地安装。这样做有一些好处：客户端和服务器可以隐式信任彼此，因为用户已授予它们运行权限。添加 API 密钥等机密信息可以使用环境变量来完成，并且永远不会离开你的机器。此外，基于 npx 和 uvx 构建还可以让用户避免显式的安装步骤。...

CVE-2026-59809 SiYuan before v3.8.0 Secret Exfiltration via http_request URL

SiYuan before v3.8.0 interpolates secret placeholders into the destination URL parameter of the httprequest MCP tool, allowing attackers to exfiltrate stored secrets. An MCP client can craft a request with an attacker-controlled URL containing secret placeholders to send plaintext secret values t...

EUVD-2026-64267

SiYuan before v3.8.0 interpolates secret placeholders into the destination URL parameter of the httprequest MCP tool, allowing attackers to exfiltrate stored secrets. An MCP client can craft a request with an attacker-controlled URL containing secret placeholders to send plaintext secret values t...

CVE-2026-50143 Actor MCP path authority injection leaks Apify token

The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.10.11, getActorMCPServerURL in src/mcp/actors.ts concatenates the trusted Actor standby URL with the attacker-controlled...

EUVD-2026-61136

The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.10.11, getActorMCPServerURL in src/mcp/actors.ts concatenates the trusted Actor standby URL with the attacker-controlled...

atomic-agents-stack: HTTP MCP catalog accepts cleartext http and spawns catalog-supplied commands (MITM to RCE)

The HTTP MCP server-registry backend factory atomicagents/mcpregistry/http.py, makehttpmcpserverregistrybackendfromurl accepts both http and https schemes. Catalog entries carry command/args that are type-validated but content-unrestricted, and are later spawned as local stdio subprocesses by...

CVE-2026-72768

n8n versions before 2.32.1 contain a server-side request forgery protection bypass vulnerability in the MCP Client node that allows authenticated users to bypass SSRF protections. Attackers can craft workflows that send requests to internal or blocked hosts without routing through SSRF protection...

EUVD-2026-56094

n8n versions before 2.32.1 contain a server-side request forgery protection bypass vulnerability in the MCP Client node that allows authenticated users to bypass SSRF protections. Attackers can craft workflows that send requests to internal or blocked hosts without routing through SSRF protection...

CVE-2026-72768 n8n before 2.32.1 SSRF Protection Bypass via MCP Client

n8n versions before 2.32.1 contain a server-side request forgery protection bypass vulnerability in the MCP Client node that allows authenticated users to bypass SSRF protections. Attackers can craft workflows that send requests to internal or blocked hosts without routing through SSRF protection...

CVE-2026-72768

n8n versions before 2.32.1 contain a server-side request forgery protection bypass vulnerability in the MCP Client node that allows authenticated users to bypass SSRF protections. Attackers can craft workflows that send requests to internal or blocked hosts without routing through SSRF protection...

CVE-2026-72768 n8n before 2.32.1 SSRF Protection Bypass via MCP Client

n8n versions before 2.32.1 contain a server-side request forgery protection bypass vulnerability in the MCP Client node that allows authenticated users to bypass SSRF protections. Attackers can craft workflows that send requests to internal or blocked hosts without routing through SSRF protection...

CVE-2026-72768

CVE-2026-72768 affects n8n versions before 2.32.1. The vulnerability resides in the MCP Client node and is a server-side request forgery protection bypass . It allows an authenticated user to bypass SSRF protections, craft workflows that send requests to internal or blocked hosts without routing ...

PT-2026-70170

n8n versions before 2.32.1 contain a server-side request forgery protection bypass vulnerability in the MCP Client node that allows authenticated users to bypass SSRF protections. Attackers can craft workflows that send requests to internal or blocked hosts without routing through SSRF protection...

GHSA-VHF8-CG2H-CG3P n8n: SSRF Protection Bypass via MCP Client Node

Impact On an n8n instance with SSRF protection enabled, the MCP Client node sent requests to a user-supplied endpoint without routing them through that protection and without pinning the resolved address. An authenticated user who could create or edit a workflow could therefore cause the server t...

Server-side Request Forgery (SSRF)

Overview @n8n/n8n-nodes-langchain is a Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the MCP Client. An attacker can access internal or otherwise restricted network resources by supplying crafted endpoints, causing the server to connect to unintended host...

CVE-2026-54149 MaxKB MCP tool import validation bypass allows post-authentication remote code execution

MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.0-lts, MaxKB tool import functionality in apps/tools/serializers/tool.py and MCP referencing mode in apps/application/chatpipeline/step/chatstep/impl/basechatstep.py do not consistently validate MCP transport type, allowing an...

CVE-2026-12774 BerriAI litellm MCP Server Connection Testing rest_endpoints.py _execute_with_mcp_client server-side request forgery

A security vulnerability has been detected in BerriAI litellm up to 1.82.2. Affected by this vulnerability is the function executewithmcpclient of the file litellm/proxy/experimental/mcpserver/restendpoints.py of the component MCP Server Connection Testing. The manipulation leads to server-side...

PT-2026-40789

Two CVEs CVE-2026-30889 and CVE-2026-31200 were classic JSON-RPC parser bugs in popular MCP client SDKs. One allowed a server response to set arbitrary properties on the client's session-state object via prototype pollution. The other allowed a server to inject batched…...

CVE-2026-42236 n8n: Unauthenticated Denial of Service via MCP Client Registration

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, the MCP OAuth client registration endpoint accepted unauthenticated requests and stored client data without adequate resource controls. An unauthenticated remote attacker could exhaust server memor...

CVE-2026-42236 n8n: Unauthenticated Denial of Service via MCP Client Registration

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, the MCP OAuth client registration endpoint accepted unauthenticated requests and stored client data without adequate resource controls. An unauthenticated remote attacker could exhaust server memor...