InfoSecBulletin Cybersecurity for mankind
Thousands of Model Context Protocol (MCP) servers have serious security flaws like file access issues, command injection, server-side request forgery (SSRF), and SQL injection. This raises big worries about the safety of AI supply chain security.
A big study of 9,695 MCP servers from well-known sites like GitHub, Glama, Lobehub, and PulseMCP shows that trusted signs like popularity, activity, and verification badges do not always show real security quality, putting organizations at risk as use grows.
Critical WordPress Plugin Flaw Exposes 600,000 Sites to Attacks
Apple Patches 28 Security Flaws in macOS, iOS, and iPadOS
DoNot (APT-C-35) Targeting Bangladesh Military Personnel
McDonald’s, Vodafone Affected by Azure Theft Campaign Exposing Millions of Records
NIST to Modernize NVD in the Age of Artificial Intelligence
ALERT
Multiple TP-Link Flaws Allow to Bypass Auth and Escalate Privileges
LiteLLM supply chain attack reveals 153GB of stolen credentials online
PATCHCORD Backdoor Targets Telecom and CII In South Asia
Fortinet Fixes Multiple Flaws in FortiWeb, FortiManager, and FortiClient
“City-Forum” Campaign
“City-Forum” Campaign Attacks Salesforce and ServiceNow Instances Worldwide
Thousands of MCP Servers Found Vulnerable
The study found 5,832 servers with security flaws. Out of those, 2,259 were confirmed to have serious flaws that could be exploited beyond just login issues.
4,982 different security problems were listed. This includes 880 cases of unwanted file access, 476 command injection errors, 422 SSRF issues, 211 SQL injection problems, and 490 denial-of-service flaws.
Additional findings showed 155 cases of cross-site scripting, authorization bypass, and 185 prompt injection cases seen as harmful actions. Importantly, 2,054 servers did not have authentication methods, and while these were not reported alone, they greatly increase the risk of other weaknesses when added together.
MCP servers connect AI agents to important resources like files, databases, APIs, and cloud systems. This helps them run code and automate work. But this special access also increases the risk of attacks.
The study showed that there is no strong link between how popular a server is and its security. Servers that are very popular (with over 50 GitHub stars) can be the most risky because many people use them, which raises the danger of one flaw affecting many users.
These servers often show SSRF, prompt injection, and file access problems linked to rich features. Mid-tier servers (10–49 stars) are the most common and have the most types of weaknesses. On the other hand, low-popularity and no-star repositories, which are often experimental or used privately, still have serious issues like command execution flaws, even though they are less visible.
Repository activity, measured by commit history, did not show better security. Projects with over 100 commits were just as vulnerable as less active ones. This means that more development can lead to more security risks without making defenses better.
Verification tools in MCP directories, like code checks and ownership tests, did not lower risk much. Verified servers had almost the same average number of problems as unverified servers.
The Trend AI Security study shows real risks in different areas. In MCP servers that focus on cryptocurrency and DeFi, researchers found problems with server-side template injection that allow remote code execution and issues with prompt injection that can change how AI agents behave.
MCP servers in businesses had problems with SQL injection and unverified Active Directory queries. This could let attackers gather information or gain more power using simple language questions handled by AI.
The study highlights a larger problem in the industry: there is no steady way to check inputs or safe development methods in the MCP system. Most security gaps were seen as mistakes made by developers, not as deliberate attacks. Still, prompt injection is a new danger in places using LLMs.
Security experts say that organizations need to stop trusting third-party MCP servers and instead use a zero-trust method.
This involves checking code, making sure users are verified and have limited access, validating all inputs, and inspecting traffic in real-time to find unusual behavior. As MCP supports the growth of AI-driven automation, the results show that security needs to improve with functionality to stop widespread abuse of connected AI systems.
