MCP Advisory Database
A public, structured database of verified security advisories affecting MCP servers, clients, and tooling. Every entry cites authoritative sources. Query it via theAdvisory API or contribute onGitHub.
- highMCPA-2026-0001ssrf
Azure MCP Server server-side request forgery allows privilege elevation (CVE-2026-26118)
Server-Side Request Forgery (SSRF) in Microsoft's Azure MCP Server allows an authorized attacker to elevate privileges over a network. Affects the npm, NuGet and PyPI distributions of Azure MCP Server Tools.
- highMCPA-2025-0005path-traversal
@modelcontextprotocol/server-filesystem symlink bypass enables full filesystem access (CVE-2025-53109)
A crafted symlink inside an allowed directory of the reference Filesystem MCP server could point anywhere on the filesystem and bypass access enforcement, giving attackers read/write access to critical files outside the sandbox and a path to code execution.
- highMCPA-2025-0004path-traversal
@modelcontextprotocol/server-filesystem path validation bypass via colliding path prefix (CVE-2025-53110)
The reference Filesystem MCP server used naive prefix matching to enforce its allowed-directories sandbox: any path that merely begins with an approved directory string (e.g. /private/tmp/allowed_dir_evil) bypassed the filter, allowing unrestricted listing, reading and writing outside the intended sandbox.
- criticalMCPA-2025-0003auth-missing
MCP Inspector proxy allows unauthenticated remote code execution (CVE-2025-49596)
Versions of Anthropic's MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests (including from malicious websites via CSRF) to launch arbitrary MCP commands over stdio on the developer's machine.
- criticalMCPA-2025-0002malicious-package
postmark-mcp npm package backdoored to exfiltrate emails via hidden BCC
The npm package `postmark-mcp`, an unofficial copy of Postmark's MCP server for sending email, turned malicious in version 1.0.16: a single added line silently BCC'd every outgoing email to an attacker-controlled address at giftshop[.]club. The package was clean through 1.0.15, making this a textbook MCP rug-pull supply-chain attack.
- criticalMCPA-2025-0001rce-vectors
mcp-remote OS command injection via untrusted MCP server (CVE-2025-6514)
mcp-remote, the widely used npm proxy for connecting local MCP clients to remote MCP servers, is exposed to OS command injection when connecting to untrusted MCP servers. A malicious server can achieve remote code execution on the client machine via crafted input in the authorization_endpoint response URL during the OAuth flow.