Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-09-14 · source-backed
CVE-2026-90898, published today, covers Maxim's Bifrost LLM gateway. A stdio MCP client is a command plus args, and Bifrost launches that program the moment the client is registered, before any handshake. governance.auth_config.is_enabled defaults to false, so a single unauthenticated POST /api/mcp/client runs code as the gateway user. transports/v2.1.0 returns 403 for unauthenticated stdio registration; v2.0.0 does not. Pair this with CVE-2026-90474 in MCPHub before 1.0.32, whose embedded OAuth server disables client auth by default and treats PKCE as optional. Two gateways, two days, same root cause: auth off by default. The patch level isn't the thing to verify, the auth flag is.
Each link below shares sources, entities, or timing with this story.
CVE-2026-90474, published September 12 at CVSS 7.6, is an authentication bypass in MCPHub's embedded OAuth 2.0 authorization server: client authentication is off by default and PKCE enforcement is optional (NVD). Two days after the Langflow and ContextForge cluster, the same s...
NVD published CVE-2026-79743 through 79750 between 18:17:19 and 18:17:20 UTC on August 31, all against the same MCP aggregator (NVD). CVE-2026-79748 lets any authenticated non-admin POST to /api/servers with arbitrary command and args, which MCPHub hands straight to child_proc...
Full 10.0. Network vector, low complexity, no authentication, no user interaction, high impact on confidentiality, integrity and availability. CVE-2026-79696, published September 9, is a code injection flaw in adk web affecting Google's Agent Development Kit for Python 2.0.0 t...
The Model Context Protocol has a security problem that's no longer theoretical — it's statistical. Between January and February 2026, researchers filed 30+ CVEs against MCP servers, clients, and infrastructure. One package with nearly 500,000 downloads carried a CVSS 9.6 RCE....
Bitdefender published the most alarming MCP security metric to date: 53% of open-source MCP server implementations rely on insecure static credentials while only 8.5% use OAuth. The report identifies five risk categories: opt-in (not default) security, supply chain poisoning,...
Censys counted 12,520 internet-accessible MCP services in June, most unauthenticated. Installing an MCP server is installing unvetted code with tool access, full stop. The concrete checklist before you trust one: require OAuth 2.1 + PKCE with token-audience validation, allow-l...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.