MCP service vulnerabilities: SQLi, SSRF, prompt injection, path traversal & mitigations

Summary of Key Information on MCP Service Vulnerabilities Vulnerability Overview Scale of Vulnerabilities: A total of 68 CVEs were identified. Notably, 91.8% of MCP services lack OAuth authentication, signaling that the AI tooling layer is emerging as a new supply chain attack surface. Vulnerability Types (Four Categories): 1. SQL Injection: By exploiting parameter filtering and concatenation in query execution, attackers can directly read the backend database. 2. Server-Side Request Forgery (SSRF): By leveraging the metadata service, attackers can access arbitrary URLs and even read local files. 3. Prompt Injection: Attackers exploit indirect tool invocations by the model, enabling file reading and execution of external data. 4. Path Traversal: By manipulating boundary conditions, attackers can read files outside of the intended directory. Lack of Authentication: 91.8% of MCP services lack OAuth authentication. With authentication controls not properly enforced, the identification of 68 vulnerabilities is not surprising. Defects in Approval Mechanisms: Flaws in command classification have rendered the approval process largely ineffective; commands are labeled as "safe" but may actually execute different, higher-privilege commands. Scope of Impact Affected Entities: MCP (Model Context Protocol) services and their ecosystem (e.g., Claude Desktop, Cursor, Windsurf, VS Code Copilot). Attack Surface: The "tooling layer" of AI agents has become a new supply chain attack surface. Data returned by tools cannot be treated as mere data; specific injections can be maliciously written into the Context. Data Leakage Risk: A single polluted log or a crafted log entry can be transformed into a command executed by the AI. Remediation Strategies (Six Recommendations from CISA) 1. Inventory: Enumerate all MCP services, including third-party service sources and asset platforms. Clarify who is using them, what tools are being used, and whether they are functional. 2. Risk Classification: Categorize vulnerabilities by severity: SQL injection, SSRF, path traversal, and prompt injection. Conduct a tiered assessment. 3. Network Isolation: Implement network segmentation, the most cost-effective and effective measure, to prevent MCP service processes from accessing sensitive cloud data, thereby blocking the SSRF vector. 4. Two-Factor Authentication: Implement authentication mechanisms and input validation alongside a patching cadence. Address AI-specific access risks, noting that models and platforms vary, and ensure this component is fully implemented. 5. Monitor Existing Lists: Align monitoring with CVE data to avoid blind spots. Pay attention to whether these CVEs are added to CISA’s Known Exploited Vulnerabilities (KEV) catalog; if listed, federal contractors must respond within mandated timeframes. 6. Compliance Benchmarking: Use the OWASP GenAI MCP Security Baseline and the MCP Sandbox Specification as benchmarks to identify gaps in your own posture. Regulators and auditors are already citing these as minimum standards. POC / Exploitation Code The page does not include specific POC or exploitation code blocks, focusing primarily on textual descriptions of vulnerability types and remediation recommendations.

Goal Reached Thanks to every supporter — we hit 100%!

MCP service vulnerabilities: SQLi, SSRF, prompt injection, path traversal & mitigations

More from this source