CVE-2026-110278

IBM ContextForge MCP Gateway 1.0.0 through 1.1.0 could allow an attacker to replay identity propagation claims signatures or expose sensitive user identity information to third-party MCP servers due to static signature payloads and missing per-gateway configuration checks during tool invocation...

Security Bulletin: IBM ContextForge MCP Gateway is affected by an information exposure vulnerability

Summary IBM ContextForge MCP Gateway can forward the identity of the calling user such as user ID, email address, groups and teams to upstream MCP servers when identity propagation is enabled, and allows this to be turned on or off for each registered upstream server. IBM ContextForge MCP Gateway...

EUVD-2026-118496

fast-agent: fast-agent serve binds HTTP to 0.0.0.0 with no authentication by default; with --shell this is unauthenticated remote command execution...

CVE-2026-102610

fast-agent is a framework for building, running, and evaluating AI agents with Model Context Protocol support. Prior to 0.7.21, fast-agent serve uses HTTP transport bound to 0.0.0.0 on port 8000 without authentication, allowing any network client that can reach the /mcp endpoint to invoke the...

CVE-2026-54140

A flaw was found in OpenHuman. The application incorporates tool descriptions and parameters from external Model Context Protocol MCP servers directly into the model context without proper sanitization or boundaries. A malicious or compromised MCP server can exploit this vulnerability to execute...

PT-2026-138437

Name of the Vulnerable Software and Affected Versions fast-agent versions prior to 0.7.21 Description The serve command uses HTTP transport bound to 0.0.0.0 on port 8000 without authentication. This allows any network client capable of reaching the /mcp endpoint to invoke the exposed agent tool. ...

@sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY

Impact When @sylphx/pdf-reader-mcp is run as an HTTP server MCPTRANSPORT=http, it reads the MCPAPIKEY environment variable and logs API key authentication enabled X-API-Key header at startup, but it never validated the X-API-Key header on incoming requests. The key was read into a variable and...

CVE-2026-93328

Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases googleapis/mcp-toolbox versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local...

CVE-2026-93328

Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases googleapis/mcp-toolbox versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local...

EUVD-2026-109936

Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases googleapis/mcp-toolbox versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local...

CVE-2026-108586

1MCP Agent @1mcp/agent 0.20.0 through 0.39.0 contains an incorrect authorization vulnerability that allows authenticated clients to bypass OAuth tag-scope enforcement using negated advanced tag-filter expressions. Attackers holding a single-tag token can send a filter like not to list and invoke...

EUVD-2026-96373

1MCP Agent @1mcp/agent 0.20.0 through 0.39.0 contains an incorrect authorization vulnerability that allows authenticated clients to bypass OAuth tag-scope enforcement using negated advanced tag-filter expressions. Attackers holding a single-tag token can send a filter like not to list and invoke...

CVE-2026-108586

The 1MCP Agent (@1mcp/agent) versions 0.20.0 through 0.39.0 are vulnerable to an incorrect authorization issue (CWE-863). This flaw allows authenticated clients to bypass OAuth tag-scope enforcement by utilizing negated advanced tag-filter expressions . Specifically, an attacker possessing a toke...

EUVD-2026-44638

PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface...

CVE-2026-80337 Unauthorized Cross-Chatbot Tool Invocation in HAVELSAN's Sef - AI Chatbot Platform

Missing Authorization vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learned that the product is not supported...

PT-2026-105836

Summary ENABLED TOOLS and TOOLSETS filters are enforced at tools/list time only. tools/call dispatches from the full unfiltered tool registry 73 tools. Any user with access to the server endpoint that knows a tool name can invoke it directly. Tool names are not secret since mcp-atlassian is open...

CVE-2026-100573

OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability in the MCP loopback component that allows sandboxed coding-agent sessions to invoke tools explicitly denied by sandbox.tools.deny policy. Attackers can list and invoke denied tools to access data or perform actions th...

CVE-2026-100573

OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability in the MCP loopback component that allows sandboxed coding-agent sessions to invoke tools explicitly denied by sandbox.tools.deny policy. Attackers can list and invoke denied tools to access data or perform actions th...

CVE-2026-100573

OpenClaw versions prior to 2026.8.1 are vulnerable to a sandbox policy bypass within the MCP loopback component . This flaw enables sandboxed coding-agent sessions to circumvent the sandbox.tools.deny policy, allowing them to list and invoke tools that were explicitly restricted by the operator. ...

CVE-2026-100545

OpenClaw npm package "openclaw" before 2026.8.1 incorrectly enforces sender tool policies during session-memory filename generation. In affected versions, filename generation created an embedded helper that retained tools which the originating sender's policy had removed. When session-memory...