Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-07-01 · high
Neither bug needs a login, and nginx-ui's flawed endpoint alone reaches more than 150 million downloads.
Why now: Both CVEs surface together in Practical DevSecOps's 2026 MCP security report, which landed in the July 1 briefing.
Two MCP developer tools shipped remote-code-execution bugs scored 9.8 on CVSS, both exploitable with a single unauthenticated HTTP request, per Practical DevSecOps.
Both tools sit on the same machine as your coding agents and your credentials. One crafted request installs new code and runs it, no login required.
CVE-2026-23744 hits the MCPJam inspector, which binds 0.0.0.0 with no authentication, so a crafted HTTP request installs an MCP server and runs arbitrary code.
CVE-2026-33032 hits nginx-ui, which counts more than 150 million downloads and whose MCP message endpoint skips authentication on command-execution requests.
That pattern repeats across both bugs: wide binds, no auth, then code execution. MCP tooling keeps treating localhost as the security boundary. These CVSS-9.8 bugs keep following.
If you run either tool, or anything like them, check what your inspector binds to. Confirm it asks for credentials before you expose it beyond localhost. Do it before you wire it into an agent workflow, not after.
Each link below shares sources, entities, or timing with this story.
Anthropic released MCP / Shared entities / Same source domain / Earlier coverage
Linked by a graph relationship (Anthropic released MCP); both cover Check, HTTP, MCP, Practical DevSecOps; reported by the same outlet (practical-devsecops.com).
Microsoft supports MCP / Shared entities / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Microsoft supports MCP); both cover CVE, HTTP, MCP, RCE; overlapping topics (auth, code).
Cursor uses MCP / Shared entities / Same source / Shared topic / What happened next
Linked by a graph relationship (Cursor uses MCP); both cover MCP, Practical DevSecOps; cite the same source (Practical DevSecOps).
Microsoft supports MCP / Shared entities / Shared topic / What happened next / Tension
Linked by a graph relationship (Microsoft supports MCP); both cover CVE, HTTP, MCP; overlapping topics (agent, request).
Claude Code uses MCP / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code uses MCP); both cover Check, MCP, RCE; overlapping topics (agent, code, credential).
Microsoft supports MCP / Shared entities / What happened next
Linked by a graph relationship (Microsoft supports MCP); both cover CVE, HTTP, MCP, RCE; picks up the CVE thread on 2026-07-13.
Microsoft supports MCP / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Microsoft supports MCP); both cover CVE, MCP, RCE; overlapping topics (agent, code).
Anthropic released MCP / Shared entities / Earlier coverage
Linked by a graph relationship (Anthropic released MCP); both cover CVE, HTTP, MCP, RCE; earlier CVE coverage from 2026-03-03.