Fetching from the wire…
01
02
03
04
05
06
07
08
Top 5 · 2026-06-17 · source-backed
OX Security disclosed a systemic vulnerability on June 16 in core Model Context Protocol implementations that enables arbitrary command execution, exposing API keys, internal databases, and chat histories on any vulnerable MCP host. This isn't one bad server. It's a protocol-level flaw, and it lands in the middle of a wave. VIPER-MCP swept around 40,000 repos and produced 67 CVEs. Akamai disclosed three database-MCP flaws. The NSA published lockdown guidance. Censys counted 12,520 internet-reachable MCP services, most of them unauthenticated.
Read that last number again. Twelve thousand MCP servers reachable from the open internet, most with no auth. MCP is the integration surface everyone's racing to adopt, the thing CircleCI, Microsoft, and Google all shipped against this week, and a big chunk of deployed instances are wide open.
It gets worse when you chain it. CISA added CVE-2026-42271 to its Known Exploited Vulnerabilities catalog amid confirmed in-the-wild attacks. It's a command-injection flaw, CVSS 8.7, in the LiteLLM gateway used by CrewAI, DSPy, Microsoft GraphRAG, and a long list of agent frameworks. Two MCP-preview endpoints accept full stdio server configs, command, args, env, and chaining that with the Starlette "BadHost" auth bypass, CVE-2026-48710, gets you unauthenticated remote code execution. That path leaks your model-provider API keys and opens lateral movement across your stack.
If you self-host an LLM gateway, this is your afternoon. Fixes shipped in LiteLLM v1.83.7 and Starlette 1.0.1+. Patch both. Then rotate every provider key that touched a vulnerable instance, because "confirmed in-the-wild" means assume compromise, not theoretical risk. Audit and authenticate every MCP server in your agent stack. The convenience of MCP, that anything can plug into anything, is exactly what makes it a near-perfect supply-chain target. We solved this in package management with signing and scanning. The MCP ecosystem is shipping integrations faster than it's shipping the security primitives to make them safe. Don't wait for the ecosystem to catch up. Lock yours down now.
Each link below shares sources, entities, or timing with this story.
Microsoft uses AWS / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Microsoft uses AWS); both cover Audit, CISA, CVE, CVEs; overlapping topics (chain, litellm).
Microsoft supports MCP / Shared entities / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Microsoft supports MCP); both cover Audit, CVE, CVEs, CVSS; overlapping topics (auth, chain, server).
Microsoft supports MCP / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Microsoft supports MCP); both cover CVE, CVEs, LiteLLM, MCP; reported by the same outlet (thehackernews.com).
Microsoft released Agent Framework / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Microsoft released Agent Framework); both cover Audit, CVE, CVEs, CVSS; overlapping topics (agent, chain, microsoft).
Microsoft supports MCP / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Microsoft supports MCP); both cover Audit, CVE, CVEs, CVSS; overlapping topics (chain, server).
Linked by a graph relationship (Microsoft supports MCP); both cover Censys, CVEs, CVSS, MCP; overlapping topics (auth, flaw, server).
Linked by a graph relationship (Microsoft supports MCP); both cover Akamai, Censys, CVEs, MCP; overlapping topics (agent, auth, server).
Microsoft uses AWS / Shared entities / Shared topic / What happened next
Linked by a graph relationship (Microsoft uses AWS); both cover LiteLLM, MCP, Microsoft, Then; overlapping topics (agent, chain, gateway, keys, litellm).