InfoSecBulletin Cybersecurity for mankind
A critical vulnerability was discovered in Smithery.ai, a well-known registry for Model Context Protocol (MCP) servers. This flaw could have let hackers steal data from over 3,000 AI servers and access API keys of thousands of users.
MCP connects AI apps to external tools and data, such as local files or remote databases. Servers can be either local or remote, with remote options often being self-hosted or fully managed.
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Cl0p Ransomware Listed 40+ Victims of PTC Windchill Campaign
Oracle Issues 943 Security Patches, Including Critical WebLogic Flaw
500+ critical infrastructure hit by Medusa ransomware
Critical WordPress Plugin Flaw Exposes 600,000 Sites to Attacks
GitGuardian reports that Smithery.ai’s hybrid model streamlines deployment by using user-submitted servers built from GitHub repos into Docker images. However, this ease of use increases risks; a single breach could affect the entire ecosystem of AI tools.
Exploiting a Simple Configuration Vulnerability:
The flaw was due to weak controls in Smithery’s build process. Users submit a smithery.yaml file, specifying the Docker build context with dockerBuildPath. While proper setups point within the repo, the system failed to validate inputs, allowing for path traversal attacks.
By setting dockerBuildPath to “..”, attackers could reference the builder machine’s home directory outside the repo, exposing sensitive files to a malicious Dockerfile.
In testing, GitGuardian crafted a repo named “test” with a rigged yaml and Dockerfile. The latter used curl to exfiltrate the directory tree to an attacker-controlled site, revealing files like .docker/config.json.
The file contained a fly.io authentication token with too many privileges, intended for Docker registry access but also allowed broader machine API access.
Fly.io hosts Smithery with virtual containers, and the token enabled an organization with 3,243 apps, primarily MCP servers, along with its service infrastructure.
With the token, attackers could query apps, execute code on machines (confirming root access via “id” command), and even sniff network traffic. Compromised servers captured HTTP requests, revealing client API keys like a Brave key in query parameters. If scaled, this could expose secrets from many clients using MCP servers, as reported by GitGuardian.
The incident shows risks in centralized AI hosting. MCP servers use static API keys instead of OAuth, making them easier targets for attacks but complicating privilege management. Salesloft’s OAuth abuse highlights how a single flaw can allow lateral movement across various trust boundaries.
Smithery fixed the traversal on June 15, 2025, after the June 13 disclosure, by rotating keys and tightening builds. As AI ecosystems expand, platforms need to focus on isolation to protect developers from widespread threats.
