A Single Day Produced Nine MCP Server CVEs, and Most Are the Same Bug
NVD published nine MCP-server advisories on 2026-08-25 alone, and the failures cluster into one shape: a local server that assumes the browser cannot reach it. PraisonAI matched origins with `startswith`; genieacs-mcp (CVE-2026-55637, 8.8) opens an unauthenticated `/mcp` on 127.0.0.1:8080 when `MCP_AUTH_TOKEN` is unset and validates neither Host nor Origin, so a website reaches it by DNS rebinding; Nextcloud MCP Server (CVE-2026-55640, 9.1) leaves `POST /webhooks/nextcloud` unauthenticated because `WEBHOOK_SECRET` defaults to None; Coroot (CVE-2026-79786, 7.0) accepts any syntactically valid redirect URI at its unauthenticated MCP OAuth registration endpoint. If your agent runs an HTTP MCP transport on loopback with no token, treat it as internet-facing.
Source
↳ Follow the thread