Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-09-18 · high
Obsidian's MCP plugin handed out OAuth codes with no login check, unlocking a static vault token every time.
Why now: NVD added all five entries during the September 16-18 window, when four unrelated projects turned out to share one missing auth check.
NVD logged five new MCP server CVEs between September 16 and 18, and four of them come down to one missing authentication check.
Anyone running one of these servers over HTTP has been exposing document search, license checks, or Kubernetes pod logs to requests with no login. In one case, a vault token that never rotates went out with it.
Obsidian Web MCP, before version 0.2.0, issued an OAuth authorization code without checking login or consent. It then exchanged that code for a static VAULT_MCP_TOKEN, according to NVD's advisory for CVE-2026-54618. Anyone who intercepted the code got the same token every time.
MCP Documentation Server 1.13.0 called app.listen(3080) with no host argument, so its document API listened on every network interface with no login required. NVD tracks it as CVE-2026-54504.
NetLicensing MCP, before 0.1.6, let requests that omitted the API key pass straight through its own middleware, tracked as CVE-2026-54446. MKP, before 0.4.1, registered a pod-log tool with no login check and no limit on how much it could return, filed as CVE-2026-50125.
The fifth entry, a path-confinement escape in yutu before 0.10.9, is a different bug class, not a missing auth check. It's tracked as CVE-2026-50158.
Four unrelated projects skipped one step. None of them verified a token before running the tool.
Anyone standing up an MCP server over HTTP should check the host binding and the auth middleware before anything else. The next disclosed MCP CVE will likely repeat this same gap in a different project.
Each link below shares sources, entities, or timing with this story.
Between September 14 and September 15, NVD published seven entries hitting MCP infrastructure. I read all of them expecting to find something clever. There's nothing clever in any of them. CVE-2026-57124, 9.8, published September 14. PraisonAI's default UI exposes POST /api/mc...
Your read-only flag is a claim, not a guarantee. Two independent Postgres MCP servers proved it on September 4. Postgres MCP Pro got CVE-2026-85620 at CVSS 9.2. The bug is one line of reasoning in safe_sql.py: the validator checks function names on FuncCall AST nodes. A functi...
The Model Context Protocol has a security problem that's no longer theoretical — it's statistical. Between January and February 2026, researchers filed 30+ CVEs against MCP servers, clients, and infrastructure. One package with nearly 500,000 downloads carried a CVSS 9.6 RCE....
CVE-2026-90474, published September 12 at CVSS 7.6, is an authentication bypass in MCPHub's embedded OAuth 2.0 authorization server: client authentication is off by default and PKCE enforcement is optional (NVD). Two days after the Langflow and ContextForge cluster, the same s...
StreamableHTTPServer.ServeHTTP and SSEServer.ServeHTTP accepted any request arriving over loopback regardless of the host it named (NVD). This one matters more than the individual server CVEs beside it because mcp-go is a widely used Go SDK, so every stdio-to-HTTP server built...
NVD posted nine advisories on August 25, clustering into one shape: a local server assuming a browser can't reach it. PraisonAI validated MCP origins with request_origin.startswith(allowed) against a localhost allowlist, so an attacker-registered localhost.attacker.com passes...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.