How real MCP vulnerabilities worked, and what fixed them.
Written by the person who found them. Each post links to the CVE record or pull request it describes.
2026-10-185 min read
The MCP tool that followed a redirect: how CVE-2026-14540 worked
A walk through the SSRF in Google's MCP Toolbox: why an HTTP client with no redirect policy is dangerous when a model supplies the parameters, and what the fix changes.
2026-10-184 min read
Why stripping the Authorization header on redirect does not work
In github-mcp-server, the usual redirect defense would have been undone by the transport itself. The fix puts the credential decision where the header is set.
2026-10-184 min read
A Low-severity CVE worth publishing: GraphQL injection through an MCP tool argument
CVE-2026-97228 in Rapid7 Bulk Export MCP is rated Low, and we say so. The pattern behind it, an unvalidated tool argument placed into a query string, is the reason to read it.