Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-07-01 · high
CVE-2026-49257 scored a perfect CVSS 10.0, per Practical DevSecOps, covering SQL, schema, and mutation tools alike.
Why now: Practical DevSecOps' MCP security findings, including this CVE, were covered on July 1.
CVE-2026-49257 hands mcp-pinot's SQL, schema, and table-mutation tools to any unauthenticated caller, drawing a perfect CVSS score of 10.0, per Practical DevSecOps.
Anyone who can reach the server gets full read, write, and delete access to the data behind it, no credentials required. That's the top of the severity scale, assigned to tools built to mutate live tables.
The cause is ordinary. OAuth doesn't ship on by default, so the server answers unauthenticated requests with the same SQL and mutation tools a logged-in caller would get. With OAuth enabled, those tools require credentials again, the way they're supposed to.
Practical DevSecOps treats this as a pattern rather than a one-off bug. Its 2026 MCP security report calls shipping auth off by default the standard failure mode across MCP servers, not an edge case.
Most MCP CVEs this year will trace back to auth left off by default, not to broken code, and mcp-pinot's perfect severity score shows how bad that default can get. If you run mcp-pinot, turn OAuth on before anything else. If you run any MCP server, treat the shipped defaults as open until you've checked otherwise.
Each link below shares sources, entities, or timing with this story.
Anthropic released MCP / Shared entities / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Anthropic released MCP); both cover CVE, CVSS, MCP; overlapping topics (auth, server, tool).
Microsoft supports MCP / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Microsoft supports MCP); both cover CVE, CVSS, MCP, OAuth; overlapping topics (oauth, server).
Anthropic released MCP / Shared entities / Same source / Shared topic / What happened next
Linked by a graph relationship (Anthropic released MCP); both cover CVE, MCP; cite the same source (Practical DevSecOps).
Anthropic released MCP / Shared entities / Shared topic / What happened next
Linked by a graph relationship (Anthropic released MCP); both cover CVE, CVSS, MCP; overlapping topics (cvss, server).
Microsoft supports MCP / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Microsoft supports MCP); both cover CVE, CVSS, MCP; overlapping topics (auth, server).
Claude Code uses MCP / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code uses MCP); both cover CVE, CVSS, MCP; overlapping topics (cvss, server).
Microsoft supports MCP / Shared entities / Earlier coverage
Linked by a graph relationship (Microsoft supports MCP); both cover CVE, CVSS, MCP, SQL; earlier CVE coverage from 2026-04-04.
Claude Code uses MCP / Shared entities / Same source / What happened next
Linked by a graph relationship (Claude Code uses MCP); both cover MCP, Practical DevSecOps; cite the same source (Practical DevSecOps).