MCP Server Security Flaws Hit Anthropic's Own Git Server

What happened

On January 20, two research teams published findings that showed the Model Context Protocol's security problems reach the companies that set its tone. Cyata researcher Yarden Porat demonstrated an exploit chain that uses Anthropic's own Git and filesystem MCP servers to achieve remote code execution (RCE). 1 The same day, BlueRock's David Onwukwe disclosed a severe server-side request forgery (SSRF) flaw in Microsoft's MarkItDown MCP server. 1

The broader finding was more troubling. After analyzing more than 7,000 MCP servers, the researchers estimated that roughly 36.7% of MCP servers on the web may carry the same latent SSRF exposure. 1

The Anthropic Git server bugs

The Cyata disclosure covers three medium-severity vulnerabilities in the official Git MCP server that Anthropic maintains. 1 Each one is individually modest. Taken together, they show how basic input-handling mistakes can stack up into something far worse.

• CVE-2025-68145 (CVSS 6.4) is a path validation bypass. Administrators can restrict the server to a specific repository path, but that restriction was not actually enforced. 1
• CVE-2025-68143 let the git_init tool create repositories anywhere on the filesystem, because the configured --repository boundary was never checked. 2 In practice, this meant any arbitrary directory could be turned into a Git repository. 1
• CVE-2025-68144 passed user-controlled arguments straight to the Git command-line tool without sanitization, which opened the door to argument injection. 2

Endor Labs notes that the two path flaws share one root cause: path arguments were never compared against the allowed scope. 2 This server has deep roots in the ecosystem. Git was among the pre-built servers Anthropic shipped when it open-sourced MCP in November 2024. At the time, the company pitched the protocol as a way to build "secure, two-way connections" between data sources and AI tools. 5

Not an isolated incident

The January disclosures follow a run of similar MCP incidents. In October 2025, a command-injection flaw (CVE-2025-53967) was found in the Framelink Figma MCP server. 3 That server is one of the ecosystem's most popular, with more than 600,000 downloads and over 10,000 GitHub stars. 2 Imperva traced the bug to a fetchWithRetry function that built curl commands from unsanitized user input. 2 AuthZed's incident timeline attributes it to unsafe use of child_process.exec with untrusted data. 3

The same timeline records two other incidents:

• A supply-chain breach at the Smithery MCP hosting service (October 2025). Attackers could run commands inside server containers and capture inbound traffic carrying API keys for downstream services. 3
• A critical Flowise vulnerability (September 2025), which AuthZed links to a systemic MCP design flaw. 3

Bad code or bad design?

The research splits on one key question: whether the problem lies mainly in individual implementations or in the protocol itself.

Endor Labs presents the Git and Figma bugs as classic application-security failures, such as missing path checks and unsanitized shell arguments, that happen to sit inside AI infrastructure. 2 Seen that way, the fix is familiar: apply standard AppSec discipline to MCP code.

The Cloud Security Alliance's labs team argues that the protocol itself is part of the problem. Its key findings include:

• MCP's STDIO transport executes operating system commands without sanitization or validation. 4
• The specification has no native defenses against tool poisoning, "rug pull" attacks, or cross-server tool shadowing. 4
• MCP defines an OAuth 2.1 authorization framework but explicitly marks it optional. A July 2025 internet scan found at least 1,862 publicly reachable MCP instances that answered unauthenticated requests. 4

The group's recommendation is to treat every MCP server as an untrusted third party and to run ongoing governance programs rather than one-off patch cycles. 4

Our reading

Both positions are correct, and they reinforce each other. The individual bugs are mundane, the kind a code review should catch. But a protocol that makes authentication optional and gives AI agents direct paths to shells, filesystems, and internal networks raises the cost of every mundane mistake. A path-check slip in an ordinary library is a nuisance. In an MCP server driven by an LLM that can be steered by untrusted content, the same slip becomes a route to code execution.

The speed of adoption adds to the risk. Anthropic's launch post highlighted how easily Claude could generate MCP server implementations, letting organizations wire up data sources quickly. 5 That ease helps explain why thousands of servers now exist and why so many may share the same weaknesses. 1

When the protocol's own creator ships reference servers with boundary-enforcement bugs, downstream developers copying those patterns deserve close scrutiny. The practical takeaway for teams deploying MCP today is the Cloud Security Alliance's: assume each server is hostile until proven otherwise, enforce authentication even though the specification does not require it, and isolate MCP tooling from sensitive systems. 4