2026 MCP Server CVE Roundup: What App Builders Should Check

A dated list of 2026 MCP server vulnerabilities, the version that fixes each, and the checks that matter if your app or your build tools use one.

Timothy Lindblom

Founder, Newly

October 24, 2026|9 min read

Published October 24, 2026Last updated October 24, 2026

At our check on October 24, 2026, public records list more than ten 2026 flaws in MCP servers and tooling from Kubernetes, Atlassian, Google and AWS projects. Most fall into three groups: a read-only setting that was not enforced, a server that fetched a URL it should not have, and a tool argument that reached a command. Update first, then limit permissions at the database or cluster.

Which MCP servers had published vulnerabilities in 2026?

An MCP server is the program that lets an AI assistant or agent use a tool, such as running a database query or listing a cluster's resources. If your app, your team or your build tools use one, it runs with whatever access you gave it. The table below lists the entries we verified against the vendor or database record. Dates are publication dates.

Server	Record	What the record describes	Fixed in	Published
mcp-server-kubernetes	CVE-2026-61459, CVSS 4.0 score 9.3	Argument injection in the kubectl get, describe and delete tools could redirect kubectl to a hostile API server and expose the operator's bearer token.	3.9.0	July 10, 2026
mcp-server-kubernetes	CVE-2026-46519, 8.8	Three environment variables documented as access controls were checked when tools were listed and skipped when tools ran.	3.6.0	June 11, 2026
mcp-atlassian	CVE-2026-27826, CVSS 3.1 score 8.2	A caller who could reach the HTTP endpoint, with no authentication, could make the server send requests to a URL the caller chose, including a cloud metadata address.	0.17.0	March 10, 2026
Google mcp-toolbox	CVE-2026-14540, 8.0 (CVSS 4.0, Google)	The generic HTTP source followed redirects without limits, so a crafted parameter could lead it to internal addresses. Affects 0.3.0 through 1.4.0.	1.5.0	July 31, 2026
mcp-remote	CVE-2026-51994, 9.1	A client-side proxy fetched a metadata URL taken from a remote server's authentication challenge. Affects 0.1.32 through 0.1.38.	See project releases	September 24, 2026
AWS DocumentDB MCP Server	CVE-2026-18954	Write-capable aggregation stages got past read-only mode, so an authenticated client could write.	1.0.12	August 5, 2026
AWS DynamoDB MCP Server	CVE-2026-85654	Crafted table, index or attribute names in a data model file could run code on the host that deploys the generated CDK app. Affects 2.0.10 through 2.1.5.	2.1.6	September 4, 2026
AWS postgres-mcp-server	CVE-2026-87911, score not given in the bulletin	Command injection in the read-only check let a COPY ... TO PROGRAM statement run operating system commands on a self-managed PostgreSQL server. AWS advises against superuser roles.	1.1.7	September 9, 2026
MCP TypeScript SDK server	CVE-2026-111771, 6.8	Bearer authentication did not check that a token was issued for this server, so a token for another service was accepted. Affects 2.0.0 through 2.2.x.	2.3.0	October 20, 2026

Two groups of entries are too recent for the table. AWS listed CVE-2026-115845 on October 23, 2026 as bulletin 2026-149-AWS, for incomplete validation in the Python sandbox of AWS MCP Server; read the bulletin index for the fixed version. On October 21, 2026 the MCP Inspector project published nine advisories, two rated critical. Inspector is a developer debugging tool, so the question is who on your team has it installed.

Reading the table

Severity scores come from different scorers and different CVSS versions, so compare them loosely. The affected version range is the part that decides whether a record applies to you. A version number read from outside is a hint about patch state and does not prove the fix is in place.

Why do the same kinds of flaw keep appearing?

MCP servers sit between a model and something valuable, and they take instructions from text a model produced. Look at where a request can go wrong on its way through, and the 2026 entries sort into four groups.

Each 2026 entry in this roundup is a gap at one of the three numbered points.

Pattern	Entries above	Check in your setup
A read-only or allow-list limit that did not hold	CVE-2026-46519, CVE-2026-18954, CVE-2026-87911	Put the limit in the database or cluster account. Then ask the server to run a write it should refuse and confirm the database refuses it.
The server fetches an address it was handed	CVE-2026-27826, CVE-2026-14540, CVE-2026-51994	Block the host's outbound traffic to private, loopback and link-local ranges, and keep the software current.
An argument or input file reaches a command or template	CVE-2026-61459, CVE-2026-85654	Pin the version, give the server a narrow account, and do not feed it data models or files from sources you have not checked.
A token accepted for the wrong service	CVE-2026-111771	Confirm the server checks that a token was issued for it, as the specification requires.

The AWS bulletin for CVE-2026-85654 describes a "context-dependent threat actor", which means the risk depends on whose files you load. The Kubernetes and PostgreSQL entries depend on how much power the account behind the server has. That is why the checks below start with the account, not the server.

What should I check in my own app and tools?

If you built your app with Newly, you can download the code or connect your own repository, so the config files named below are yours to read. AI features inside your app use credits, which is one more reason an endpoint that anyone can call is worth finding. Work through these in order.

List every MCP server. Search editor settings, repository config files and container or hosting definitions. Write down the name, version, where it runs and who can reach it.
Compare versions with the table. Where the server is an npm or Python package, npm ls or pip show prints the installed version. For a container, read the image tag, then confirm the container was restarted after the update.
Check the front door. The MCP authorization specification makes authorization optional, but an HTTP server that uses it must return 401 when a token is missing or invalid and must accept only tokens issued for itself. Tokens belong in the Authorization header, never in the URL. Our MCP authorization checklist walks through it.
Keep local servers local. The specification's security guidance suggests stdio for local servers, or an authorization token or a restricted channel if they use HTTP. OWASP's MCP cheat sheet adds binding to localhost and rejecting unexpected Origin and Host headers.
Limit the account behind the server. For the PostgreSQL case, AWS advises a dedicated role with only CONNECT, USAGE and SELECT for read-only use. For DocumentDB, its interim advice was read-only database credentials.
Restrict outbound connections. The specification lists the ranges to block: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, loopback and 169.254.0.0/16, which includes the cloud metadata address. It also warns against writing the address checks by hand, and suggests an egress proxy.
Rotate what the server could read. If an affected version ran where untrusted people or content could reach it, treat its tokens as exposed. Our guide to rotating secrets lists the order.

Developer tools belong on the list too. Supply chain incidents such as the one covered in AI and LLM tooling supply chain attacks show how a package you install for convenience gets the same reach as your own code.

What can an outside scan tell me about an MCP server?

Only what the server shows to the public internet. An MCP server that uses stdio, or listens on a private network, never appears to an outside scan, which tells you nothing about whether it is patched. The free scan on red.run.cloud reads the stack a live site serves and matches versions to public records. That is a lookup. It can say a version is affected, and it cannot say whether your setup is exposed.

So read your results in three states. Detected means an outside check saw a version below the fix. Unknown is the common case: the version is hidden, a vendor may have backported a fix, or the server is not reachable from outside. Confirmed by owner evidence needs something only you can supply, such as the installed version plus a restart after the update. For servers you deliberately put on a public address, see how to check whether yours is exposed. For the rest of the app, start with the 15-minute check. All pages are listed in the security hub.

Where do you stand?

Everything starts as unknown, because that is what an unchecked item is. Move an item to confirmed only when you hold the evidence listed under it.

Your MCP server check

Detected: You found the problem.
Unknown: Not checked yet, or the check could not tell.
Confirmed by owner evidence: You checked and kept the proof.

1. You have a written list of every MCP server your app, your team and your build tools use, with its name, version and where it runs.
Evidence: the list itself, built from editor settings, repository config files and container or hosting definitions.
2. Each server on the list is at or above the fixed version in the table, or is not one of the products named there.
Evidence: version output from each machine or image, such as npm ls or pip show, saved with the date.
3. Every server reachable over HTTP answers 401 without a token, and local servers use stdio or an address only your machine can reach.
Evidence: the status code you saw from a request with no token, and the listen address from the config.
4. The database or cluster account behind each server can only do what you intend, even if the server's own setting is bypassed.
Evidence: the role definition showing read-only grants, and a refused write from that role.
5. The host that runs each server cannot open connections to private, loopback or link-local addresses it has no reason to reach.
Evidence: the network or firewall rule, or the egress proxy setting.
6. Every token and key an affected server could read has been rotated, or you have a note showing why it was never exposed.
Evidence: the rotation date for each credential, or the note and who wrote it.

0 detected6 unknown0 confirmed by owner evidence

Your answers stay in this browser tab. Nothing is saved or sent.

Frequently asked questions

Does this matter if my app only runs on phones?

The app on the phone does not run an MCP server. The tools around it might: an assistant that reads your tickets, a database helper your team uses while building, or a backend that lets an AI feature call tools. Those run on laptops and servers, and those are the places to check.

Is a local MCP server in my editor reachable from the internet?

Not by default if it uses stdio, which limits access to the client that started it. The MCP specification says local servers that use an HTTP transport should require an authorization token or use a restricted channel such as a Unix domain socket. Check how each one is started, and which address it listens on.

Why do some of these flaws have two different severity scores?

Scores depend on who scored and which CVSS version they used. For CVE-2026-14540, Google, as the CNA, published 8.0 under CVSS 4.0, while NVD lists 6.1 under CVSS 3.1. Use the score to rank your work, and let the affected version range decide whether you are in scope.

I updated the server. Do I still need to rotate credentials?

Rotate when the server held a token or key and ran an affected version while people you do not trust could reach it, or could send it input. If it only ran on your own machine with data you wrote yourself, an update may be enough. Write down which case applies and keep the note.

Is a read-only mode enough to protect my database?

No. Two of the 2026 entries, CVE-2026-46519 and CVE-2026-18954, were about read-only or allow-list settings that did not hold. AWS's interim advice for the DocumentDB case was to connect with credentials that are read-only at the database itself. Put the limit in the database role, and treat the server setting as a second layer.

How often will this list change?

Often. An AWS bulletin, a TypeScript SDK advisory and nine MCP Inspector advisories appeared between October 20 and October 23, 2026. The date at the top is the date of our check. Before you act on a row, open its source link and read the current record.

Sources

All records were opened on October 24, 2026.

NVD: CVE-2026-27826 (mcp-atlassian), NIST National Vulnerability Database
GHSA: mcp-server-kubernetes argument injection (CVE-2026-61459), GitHub Advisory Database
NVD: CVE-2026-46519 (mcp-server-kubernetes), NIST National Vulnerability Database
NVD: CVE-2026-14540 (Google mcp-toolbox), NIST National Vulnerability Database
NVD: CVE-2026-51994 (mcp-remote), NIST National Vulnerability Database
Bulletin 2026-076-AWS: DocumentDB MCP Server (CVE-2026-18954), AWS Security Bulletins
Bulletin 2026-097-AWS: DynamoDB MCP Server (CVE-2026-85654), AWS Security Bulletins
Bulletin 2026-104-AWS: postgres-mcp-server (CVE-2026-87911), AWS Security Bulletins
AWS security bulletins index (2026-149-AWS, CVE-2026-115845), AWS Security Bulletins
MCP TypeScript SDK bearer audience flaw (CVE-2026-111771), GitLab Advisory Database
Security advisories for modelcontextprotocol/inspector, GitHub
MCP specification 2026-07-28: Authorization, modelcontextprotocol.io
MCP specification 2026-07-28: Security best practices, modelcontextprotocol.io
MCP Security Cheat Sheet, OWASP Cheat Sheet Series

Continue Learning

MCP authorization checklist for the 2026-07-28 spec →

The authentication rules this roundup keeps pointing back to.

Exposed self-hosted AI endpoints: how to check yours →

How to tell whether a service you run answers the public internet.