InfoSecBulletin Cybersecurity for mankind
A critical vulnerability was discovered in Smithery.ai, a well-known registry for Model Context Protocol (MCP) servers. This flaw could have let hackers steal data from over 3,000 AI servers and access API keys of thousands of users.
MCP connects AI apps to external tools and data, such as local files or remote databases. Servers can be either local or remote, with remote options often being self-hosted or fully managed.
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GitGuardian reports that Smithery.ai’s hybrid model streamlines deployment by using user-submitted servers built from GitHub repos into Docker images. However, this ease of use increases risks; a single breach could affect the entire ecosystem of AI tools.
Exploiting a Simple Configuration Vulnerability:
The flaw was due to weak controls in Smithery’s build process. Users submit a smithery.yaml file, specifying the Docker build context with dockerBuildPath. While proper setups point within the repo, the system failed to validate inputs, allowing for path traversal attacks.
By setting dockerBuildPath to “..”, attackers could reference the builder machine’s home directory outside the repo, exposing sensitive files to a malicious Dockerfile.
In testing, GitGuardian crafted a repo named “test” with a rigged yaml and Dockerfile. The latter used curl to exfiltrate the directory tree to an attacker-controlled site, revealing files like .docker/config.json.
The file contained a fly.io authentication token with too many privileges, intended for Docker registry access but also allowed broader machine API access.
Fly.io hosts Smithery with virtual containers, and the token enabled an organization with 3,243 apps, primarily MCP servers, along with its service infrastructure.
With the token, attackers could query apps, execute code on machines (confirming root access via “id” command), and even sniff network traffic. Compromised servers captured HTTP requests, revealing client API keys like a Brave key in query parameters. If scaled, this could expose secrets from many clients using MCP servers, as reported by GitGuardian.
The incident shows risks in centralized AI hosting. MCP servers use static API keys instead of OAuth, making them easier targets for attacks but complicating privilege management. Salesloft’s OAuth abuse highlights how a single flaw can allow lateral movement across various trust boundaries.
Smithery fixed the traversal on June 15, 2025, after the June 13 disclosure, by rotating keys and tightening builds. As AI ecosystems expand, platforms need to focus on isolation to protect developers from widespread threats.
