MCP Security Debt Hits Critical Mass: 30+ CVEs in 60 Days, PraisonAI CVSS 10, Azure AI Foundry CVSS 10

Thirty CVEs in sixty days. That's the MCP ecosystem's security track record for 2026 so far, and the severity is climbing.

Three disclosures dropped this week that should make anyone running agent infrastructure pause. First, PraisonAI, a popular multi-agent orchestration framework, got hit with five CVEs at once. The worst is CVE-2026-34938, a CVSS 10 sandbox bypass that chains to remote code execution on any version before 1.5.90. All three sandbox layers fail. The other four cover SQL injection via f-string thread IDs (CVE-2026-34934, CVSS 9.8), CLI command injection through the --mcp argument (CVE-2026-34935, CVSS 9.8), unauthenticated WebSocket agent control (CVE-2026-34952, CVSS 9.1), and a SubprocessSandbox escape via missing sh/bash blocklist (CVE-2026-34955, CVSS 8.8). This mirrors the CrewAI CVE cluster from last week. The pattern is clear: multi-agent framework sandboxing is systematically broken across the ecosystem.

Second, Azure AI Foundry got a CVSS 10 privilege escalation (CVE-2026-32213). No prior authentication required. Any network attacker can escalate to full admin over Azure AI Foundry resources. Microsoft says a fix is available through MSRC, but if you're running AI workloads on Azure AI Foundry and haven't patched, stop reading this and go patch.

Third, CVE-2026-32211 hit the Azure MCP Server itself at CVSS 9.1, plus CVE-2026-5322 for SQL injection in mcp-data-vis.

I've been saying this for weeks: MCP servers aren't development toys. They're network-exposed services. The security posture most teams apply to them, which is basically none, made sense when MCP was a local dev protocol. That phase is over. The vulnerability pattern has shifted from client-side tool poisoning and prompt injection to server-side authentication failures in production cloud services. That's a different threat class entirely.

What to do right now: audit every MCP server in your stack for authentication. Patch PraisonAI to 1.5.90+. Verify Azure AI Foundry patches. Treat your MCP endpoints like you'd treat a public API endpoint, because that's what they are.