Active exploitation4 min read
CVE-2026-59822
A milestone nobody wanted: a Model Context Protocol implementation is now on the CISA Known Exploited Vulnerabilities catalog. LiteLLM — the open-source proxy that routes traffic between apps and LLMs — fails authentication on its MCP Streamable HTTP endpoint: any arbitrary bearer token (researchers demonstrated the single letter "a") is accepted, converted internally from a 401 into a valid session. Chained with a separate root-level RCE (CVE-2026-59821, unrestricted exec() in custom code guardrails), pre-auth root on the model gateway is achievable. Wiz scanned 3,074 internet-exposed LiteLLM instances: 9.6% (295) accept the default master key "sk-1234" or need no auth at all. LiteLLM sits in roughly a third of cloud environments — check yours today.
Sources: Wiz disclosure coverage · KEV analysis
Research2 min read
arXiv 2609.14119
The largest systematic look at the official MCP registry so far: 21,643 servers and 72,606 version records from the August 2026 snapshot, source code pulled for 14,353 of them, scanned with an eight-class threat catalogue validated against 414 hand-labeled findings. Headline: 15.2% of scanned servers carry at least one weakness and 11.1% at least one high-severity one — dominated by unauthenticated network exposure. The paper also documents "silent drift": same registry name, different server over time. The registry distributes community servers with essentially none of the vetting mature package ecosystems have.
Sources: Paper (PDF)
Research2 min read
arXiv 2609.14119
Beyond point-in-time weaknesses, the census tracks registry integrity itself: servers whose code no longer matches what their registry entry promises. For agent builders this is the supply-chain problem in miniature — you pin a name, not a hash, and the name can quietly stop being the thing you vetted. Practical takeaway: pin versions, verify source, re-scan on every bump. Our own registry scans at FlowSentry found the same pattern: placeholder entries like a literal {api_host} host that never got validated by the registry.
Sources: Paper (PDF)
Governance2 min read
Announced Sept 10, 2026
Enterprise IAM is waking up to agents: JumpCloud's Agentic IAM update auto-discovers MCP server configurations across an organization and routes them through a governed AI Gateway, treating each agent as a first-class identity that can be audited, restricted, or revoked. The stats behind the push: 30 CVEs filed against MCP infrastructure in 60 days (Jan-Feb 2026), 82% of MCP deployments vulnerable to path traversal, only 8.5% using OAuth, and 88% of organizations have had or suspect an agent-related security incident in the past year. Machine identities outnumber humans 109:1 in the average enterprise; only 14.4% of agents reach production with full security approval.
Sources: Coverage
Agent payments2 min read
x402 / AP2 / MPP
Agent-to-agent payments are no longer an experiment: x402 reported 165 million transactions across 69,000 active agents by late April 2026 (~$50M cumulative volume), and the protocol stack has consolidated into three live layers — x402 for per-request execution (Coinbase/Cloudflare), Google's AP2 for pre-authorized spending mandates, and MPP for card-rail settlement. Nous Research enabled x402 payments for Hermes 4 model access; Cloudflare added Workers-native middleware. If you build agents, the practical read: per-request USDC on Base is the default rail, and your agent needs a wallet the way it needs an API key.
Sources: Galaxy Research · Protocol comparison
Tooling2 min read
Ecosystem
September alone: the official Kotlin SDK published two Streamable HTTP DoS advisories (CVE-2026-63658 high, CVE-2026-63657 medium), the ssh-mcp maintainer rated a command classifier bypass at CVSS 9.9 (GHSA-qvx5-rxrj-9vfh — the read-only gate reads something different from what the shell executes), and Argo CD's MCP server took sessions from anyone who could reach it (CVE-2026-82456, flat 10.0). One feed now catalogs 771 MCP entities with verified facts. We track the security-relevant slice daily and publish the ones that matter for builders here — the raw scanner output lives on our sister site HurtfulTruth.
Sources: MCP News tracker
Opinion2 min read
Opinion
Every agent framework treats tool servers as trusted plug-ins. That default made sense when everything ran on localhost — it is the wrong default on the open internet. Here are the six checks any MCP endpoint should pass before an agent touches it: auth posture, transport hardening, header hygiene, tool-description integrity, session handling and dependency provenance.
Sources:
Explainer2 min read
Explainer
HTTP 402 has existed as a placeholder since 1997. In 2026 it carries settled USDC between machines. What an agent actually sends on a paid call, where the facilitator fits, why Base keeps fees negligible, and how to price a machine-to-machine API without losing the human market.
Sources:
The running list of MCP-ecosystem vulnerabilities that matter to builders, updated as new advisories land. Background: the OX Security STDIO design flaw (April 2026) put an estimated 200,000 servers at risk of takeover and spawned the CVE wave below — the flaw is architectural, so every downstream project patches it separately. We track the wave so you can track your exposure.
Every daily issue, newest first — each compiled from live-measured sources the same morning.
