MCP Security Crisis: CVEs Mount as Identity Work Lags Behind

A protocol growing faster than its defenses

The Model Context Protocol (MCP), the standard that lets AI agents call databases, APIs, file systems and cloud services through a common interface, has become core enterprise plumbing in roughly two years. Its security model has not kept pace. Security firm UltraViolet says MCP now runs agent workflows in most Fortune 500 companies, yet the protocol ships without built-in authentication or authorization 2. The result in 2026 has been a steady stream of vulnerability disclosures, alongside a governance roadmap that still lists its identity working group as "forming."

What researchers found

The most consequential finding concerns MCP's standard input/output (STDIO) transport. A technical analysis by OX Security, described by AuthZed, found that the transport lets configuration flow directly into command execution without adequate sanitization 1. Through functions such as StdioServerParameters, attackers can run arbitrary operating-system commands. The issue also reaches downstream tooling, including LangChain's MCP adapters 1. Researchers dubbed it "The Mother of All AI Supply Chains," and the work produced more than 30 disclosures and 10 CVEs across several languages, touching software with over 150 million downloads 1.

The flaw has already been used in practice. Researchers achieved authenticated remote code execution on Letta AI, unauthenticated server takeover on LangFlow through exposed MCP configurations, and a bypass of security filters in Flowise 1. Windsurf was also affected 1. The Agent Report traces the problem to Anthropic's official SDKs for Python, TypeScript, Java and Rust. It credits researchers Moshe Siman Tov Bustan, Mustafa Naamnih, Nir Zadok and Roni Bar, and lists critical CVEs in GPT Researcher, LiteLLM, DocsGPT, Bisheng and a zero-click Windsurf bug 3.

Other incidents point the same way. UltraViolet notes that Microsoft patched a high-severity flaw in its own MCP servers in its March 2026 release 2. AuthZed records a critical MCP integration flaw in nginx-ui the same month 1. The Agent Report highlights the DuneSlide pair (CVE-2026-50548/50549), a CVSS 9.8 sandbox-escape chain disclosed by Cato AI Labs 3. It also lists other attack vectors: prompt injection through tool responses, malicious server registries and config-file hijacking 3.

Where the numbers diverge

The tallies don't line up neatly, and readers should treat them carefully. UltraViolet counts more than 40 CVEs against MCP implementations between January and April 2026, spanning reference servers and third-party tools 2. The Agent Report counts 14 CVEs as of July 3, and AuthZed attributes 10 to the STDIO research alone 1. The gap most likely reflects scope. The narrower figures track the SDK design flaw specifically, while UltraViolet's broader count covers the wider MCP ecosystem.

Exposure estimates differ in the same way. The Agent Report puts the number of servers open to remote code execution through the SDK design choice at over 200,000 3. UltraViolet more loosely cites "hundreds of thousands" of vulnerable servers worldwide 2. The Agent Report also notes that more than 800 MCP servers have been independently scored for security risk 3. Whatever the exact count, every source agrees the attack surface is large and growing.

The roadmap's answer, and its timing

MCP's official roadmap does address these problems, at least on paper. One priority is unifying transports. Maintainers Kurtis Van Gent and Nick Cooper describe the burden of running separate HTTP and STDIO pipelines, and propose "HTTP over stdio": Streamable HTTP as the single binding, with HTTP/2 carried over a subprocess's stdin/stdout 4. They argue this keeps the security and lifecycle guarantees of a subprocess 4. If it works, it could shrink the duplicated, cross-validated metadata that complicates the current design.

A separate priority covers agent identity and enterprise security. The roadmap plans to finalize Demonstrating Proof of Possession (DPoP) and push for its adoption. It also aims to give servers an "opinionated" way to recognize agents acting under their own identity or a user-delegated one 4. Both items sit with an Agent Identity Working Group that the roadmap describes as still forming during this period 4.

Reading the situation

The pattern is a familiar one: adoption ran ahead of security design, and patching individual products is now standing in for an architectural fix. AuthZed's assessment is pointed. Because the STDIO transport permits subprocess execution by design, ad hoc input filtering is not a sufficient defense 1. Each new CVE in a downstream tool is partly a symptom of that root cause.

The roadmap shows the maintainers understand the problem. But a working group that hasn't yet formed is not a deployed control, and enterprises can't wait for spec revisions to reach SDKs and then production. Until identity and transport hardening land, organizations running MCP should apply the controls UltraViolet recommends 2. They should also inventory their exposed servers and treat MCP configuration as untrusted, executable input.