Your MCP Server Is the Attack Surface Now

A wave of Model Context Protocol vulnerabilities disclosed in late September and October 2026 exposed remote code execution, server-side request forgery, unauthenticated debugger access and credential theft across both third-party and official MCP servers, including Langflow (CVE-2026-105697, CVSS 9.9), the official mcp-server-fetch package (CVE-2026-104120) and the official MCP Python SDK. Independent researcher Syed Anas Mohiuddin found the same SSRF flaw over five months in servers at Google, JPMorgan Chase, Weaviate, Rapid7 and government agencies, and the MCPTox benchmark measured attack success rates up to 72.8 percent against 45 real MCP servers. The post attributes the pattern to the MCP specification's lack of normative security requirements and promotes the RelayShield MCP Proxy Firewall as a runtime screening layer.

October 2026 has been the worst month yet for Model Context Protocol security. Not because attackers discovered something new, but because they keep rediscovering the same flaws in server after server. Here is what happened in the last two weeks alone. Langflow RCE CVE-2026-105697, CVSS 9.9 . Disclosed October 5. Langflow executed the command field from MCP server configs with no allowlist, wrapped in bash -c . Any authenticated user could run arbitrary OS commands on the host. A public proof of concept is available. Fixed in 1.9.0 and 1.10.3. Official fetch server SSRF CVE-2026-104120, CVSS 7.3 . Published October 2. The fetch url tool in the official modelcontextprotocol/mcp-server-fetch package allowed server-side request forgery through the url argument. Remotely triggerable. This is the reference implementation shipping the vulnerability. Unauthenticated debugger CVE-2026-107824, CVSS 9.3 . Published October 9. The x64dbg MCP server exposed every debugger tool over HTTP with no authentication, listening on all interfaces by default. Any network client could attach to processes, read and write memory, and write arbitrary files. Python SDK credential theft September 29, CVSS 7.5 . The official MCP Python SDK sent client secrets, authorization codes, and PKCE proof keys to attacker-controlled token endpoints. Reported by Cycode. Client secrets are long-lived, so the blast radius extends well past the patch in 1.30.0 and 2.2.0. Independent researcher Syed Anas Mohiuddin spent five months finding the same SSRF flaw across Google, JPMorgan Chase, Weaviate, Rapid7, a French government directorate, and an Indonesian city government. Five US federal AI servers, including one logging veterans' SSNs in unredacted error responses, were still unpatched six weeks after disclosure. His conclusion is blunt: the MCP specification has no normative security requirements, and its implicit-trust model means independent teams keep rediscovering the same vulnerability class. The numbers back him up. The MCPTox benchmark tested 20 LLM agents against 45 real MCP servers and measured attack success rates up to 72.8 percent. More capable models were more vulnerable, not less. Koi Security found the first real-world malicious MCP server in September 2025: fifteen clean releases of the postmark-mcp package, then a quiet update that BCC'd every agent-sent email to an attacker. MCP has crossed 97 million installs. The registry is approaching 2,000 entries. The attack surface is growing faster than anyone's ability to audit it by hand. Static rules do not keep up. Every one of the CVEs above was a novel instance of a known class in a new codebase. What catches them is screening tool calls and responses against live threat intelligence: known-bad indicators, phishing-kit fingerprints, scam-associated infrastructure, and neighbor servers with dirty reputations. That is what the RelayShield MCP Proxy Firewall does. It sits between your agents and their MCP servers, screens every tool call and every response, and blocks or flags what matches the corpus. The pre-deployment scanner is free and catches misconfigurations before you ship. The runtime proxy is $49 a month. Your MCP server is the attack surface now. Screen it like one.