Tag archive

Model Context Protocol

Coverage tagged model context protocol.

Data graphic: MCP server steals OAuth secrets. CVSS 7.5 High 6.5 for the interactive provider ; affected mcp 1.9.1–1.29.1 and 2.0.0–2.1.1, fixed in 1.30.0 / 2.2.0, M2M providers must also pass issuer=. An attack path runs from the MCP client to a malicious MCP server to the auth server it picked, which receives the client_secret and PKCE verifier.

Official MCP Python SDK Let Malicious Servers Steal OAuth Secrets, and Upgrading Isn't Enough

A flaw in the official MCP Python SDK let a hostile MCP server redirect OAuth client secrets. Fixed in 1.30.0 and 2.2.0, but M2M providers also need issuer=.

Related desks

AI Security

Latest

Oct 2, 2026, 8:06 AM EDT · Exploits · Cve 2026 54305 minWSO2 API Manager JWT Bypass Exploited 133 Days After the Fix

Forged admin tokens for WSO2 API Manager flaw CVE-2026-5430 (CVSS 10.0) hit honeypots 133 days after the fix. CISA's KEV entry describes the wrong bug.

Oct 2, 2026, 8:06 AM EDT · AI Security · Cve 2026 615005 minMythos Cracked Rejetto HFS Sessions From 12 Leaked Math.random() Values

Horizon3 used Anthropic's Mythos to find CVE-2026-61500: Rejetto HFS 3.x leaks Math.random() values that let attackers forge admin cookies. Fixed in 3.2.1.

Oct 2, 2026, 8:06 AM EDT · Exploits · Cve 2026 941274 minF5 BIG-IP APM: An Oversized Bearer Token Is Enough for Unauthenticated RCE

An unauthenticated attacker can run code on F5 BIG-IP APM with one oversized Bearer token — but only when APM is configured as an OAuth Authorization Server.

Oct 2, 2026, 8:06 AM EDT · Exploits · Cve 2026 869505 minApple Patches CoreGraphics Zero-Day Used Against Targeted iPhone Users

CVE-2026-86950, a CoreGraphics out-of-bounds write hit via a crafted file, was exploited on iOS before 27. Update to iOS 26.7.1, macOS 26.7.1 or 15.8.1.