{"slug": "your-mcp-server-is-the-attack-surface-now", "title": "Your MCP Server Is the Attack Surface Now", "summary": "A wave of Model Context Protocol vulnerabilities disclosed in late September and October 2026 exposed remote code execution, server-side request forgery, unauthenticated debugger access and credential theft across both third-party and official MCP servers, including Langflow (CVE-2026-105697, CVSS 9.9), the official mcp-server-fetch package (CVE-2026-104120) and the official MCP Python SDK. Independent researcher Syed Anas Mohiuddin found the same SSRF flaw over five months in servers at Google, JPMorgan Chase, Weaviate, Rapid7 and government agencies, and the MCPTox benchmark measured attack success rates up to 72.8 percent against 45 real MCP servers. The post attributes the pattern to the MCP specification's lack of normative security requirements and promotes the RelayShield MCP Proxy Firewall as a runtime screening layer.", "body_md": "October 2026 has been the worst month yet for Model Context Protocol security. Not because attackers discovered something new, but because they keep rediscovering the same flaws in server after server.\n\nHere is what happened in the last two weeks alone.\n\n**Langflow RCE (CVE-2026-105697, CVSS 9.9).** Disclosed October 5. Langflow executed the `command` field from MCP server configs with no allowlist, wrapped in `bash -c`. Any authenticated user could run arbitrary OS commands on the host. A public proof of concept is available. Fixed in 1.9.0 and 1.10.3.\n\n**Official fetch server SSRF (CVE-2026-104120, CVSS 7.3).** Published October 2. The `fetch_url` tool in the official `modelcontextprotocol/mcp-server-fetch` package allowed server-side request forgery through the `url` argument. Remotely triggerable. This is the reference implementation shipping the vulnerability.\n\n**Unauthenticated debugger (CVE-2026-107824, CVSS 9.3).** Published October 9. The x64dbg MCP server exposed every debugger tool over HTTP with no authentication, listening on all interfaces by default. Any network client could attach to processes, read and write memory, and write arbitrary files.\n\n**Python SDK credential theft (September 29, CVSS 7.5).** The official MCP Python SDK sent client secrets, authorization codes, and PKCE proof keys to attacker-controlled token endpoints. Reported by Cycode. Client secrets are long-lived, so the blast radius extends well past the patch in 1.30.0 and 2.2.0.\n\nIndependent researcher Syed Anas Mohiuddin spent five months finding the same SSRF flaw across Google, JPMorgan Chase, Weaviate, Rapid7, a French government directorate, and an Indonesian city government. Five US federal AI servers, including one logging veterans' SSNs in unredacted error responses, were still unpatched six weeks after disclosure.\n\nHis conclusion is blunt: the MCP specification has no normative security requirements, and its implicit-trust model means independent teams keep rediscovering the same vulnerability class.\n\nThe numbers back him up. The MCPTox benchmark tested 20 LLM agents against 45 real MCP servers and measured attack success rates up to 72.8 percent. More capable models were more vulnerable, not less. Koi Security found the first real-world malicious MCP server in September 2025: fifteen clean releases of the postmark-mcp package, then a quiet update that BCC'd every agent-sent email to an attacker.\n\nMCP has crossed 97 million installs. The registry is approaching 2,000 entries. The attack surface is growing faster than anyone's ability to audit it by hand.\n\nStatic rules do not keep up. Every one of the CVEs above was a novel instance of a known class in a new codebase. What catches them is screening tool calls and responses against live threat intelligence: known-bad indicators, phishing-kit fingerprints, scam-associated infrastructure, and neighbor servers with dirty reputations.\n\nThat is what the RelayShield MCP Proxy Firewall does. It sits between your agents and their MCP servers, screens every tool call and every response, and blocks or flags what matches the corpus. The pre-deployment scanner is free and catches misconfigurations before you ship. The runtime proxy is $49 a month.\n\nYour MCP server is the attack surface now. Screen it like one.", "url": "https://wpnews.pro/news/your-mcp-server-is-the-attack-surface-now", "canonical_source": "https://dev.to/relayshield/your-mcp-server-is-the-attack-surface-now-1em8", "published_at": "2026-10-15 17:40:56+00:00", "updated_at": "2026-10-15 17:54:48.347220+00:00", "lang": "en", "topics": ["ai-agents", "agent-protocols", "ai-safety", "ai-tools"], "entities": ["Model Context Protocol", "Langflow", "mcp-server-fetch", "MCP Python SDK", "Syed Anas Mohiuddin", "Cycode", "Koi Security", "RelayShield"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/your-mcp-server-is-the-attack-surface-now", "markdown": "https://wpnews.pro/news/your-mcp-server-is-the-attack-surface-now.md", "text": "https://wpnews.pro/news/your-mcp-server-is-the-attack-surface-now.txt", "jsonld": "https://wpnews.pro/news/your-mcp-server-is-the-attack-surface-now.jsonld"}}