MCP Server Security 2026: 118 Vulnerability Findings Across 68 Packages — Classic Web Flaws Inherited Into Agent Infrastructure

DEV Community·medium signal

A new DEV Community security report documented 118 findings across 68 MCP server packages, categorizing all vulnerabilities as classic web security classes: SSRF, path traversal, injection, and unsafe deserialization. This package-level code analysis is distinct from the earlier BlueRock network scan of 8,000 servers and goes deeper into implementation flaws. The pattern confirms that MCP infrastructure is inheriting decades of web security debt rather than being designed with agent-grade trust boundaries from the ground up.