AI Governance Institute
← News
Research2026-09-11

68 MCP Server CVEs in One Month Expose a Systemic Agent Supply Chain Gap

What happened

Adversa AI published its MCP security September 2026: Deadbugz + 3 server CVEs roundup on September 7, 2026, documenting 68 reportable vulnerabilities discovered across audited MCP servers during the preceding period. The vulnerability classes identified include SQL injection, server-side request forgery targeting cloud metadata services, prompt template injection, and path traversal, each of which can enable data exfiltration, credential theft, or agent hijacking in a live enterprise deployment. The report names specific CVEs alongside a campaign tracked as Deadbugz, providing concrete artifacts that compliance and security teams can use to assess exposure in their own toolchains. This roundup follows a prior audit finding that 91.8% of audited MCP servers lack OAuth, and builds on related research on MCP server context injection across 19 servers, confirming that the MCP layer represents a repeating, systemic vulnerability pattern rather than an isolated finding. Enterprises relying on agentic platforms that connect to external MCP servers are exposed through dependencies they have typically not evaluated as part of their standard AI procurement or vendor risk processes.

Why it matters

  • ·Most enterprise vendor due diligence programs assess the AI model or agent platform, but not the MCP server layer those platforms depend on. With 68 vulnerabilities catalogued in a single month, including SSRF flaws that can harvest cloud metadata credentials, the MCP server tier now represents a material, ungoverned segment of the agent supply chain that procurement risk assessments must explicitly cover.
  • ·SSRF and SQL injection flaws in MCP servers can compromise the integrity of agent audit trails and expose regulated data, creating direct exposure under data protection regimes and sector-specific rules. Organizations in financial services, healthcare, and critical infrastructure face the highest consequence if an MCP server vulnerability enables credential exfiltration or unauthorized data access during an agent workflow.
  • ·The pattern documented across prior MCP audits and this month's findings signals that MCP server insecurity is structural, not episodic. Compliance teams that have not added MCP server dependency mapping and vulnerability tracking to their agent governance programs are operating with a control gap that regulators and insurers are increasingly likely to treat as a failure of reasonable care.

Governance controls affected

AGT-019AI Tool and Plugin Supply Chain Risk AssessmentAGT-008Agent Environment IsolationAGT-001Agent Permission BoundariesPRC-001AI Vendor Due DiligenceSEC-001Prompt Injection Prevention

What to do now

  • ☐Inventory every MCP server your agentic platforms connect to, including third-party and open-source implementations, and confirm whether each has been assessed for SQL injection, SSRF, path traversal, and prompt template injection vulnerabilities.
  • ☐Map the Deadbugz campaign indicators and the three named CVEs from the Adversa AI September 2026 report against your current MCP server deployments and initiate patching or isolation for any confirmed matches.
  • ☐Extend your AI vendor due diligence questionnaire to explicitly cover MCP server security controls, including authentication mechanisms, input validation practices, and patch cadence, for all agent toolchain dependencies.
  • ☐Apply network-layer isolation controls to MCP servers so that cloud metadata service endpoints are unreachable from agent-accessible server processes, directly mitigating the SSRF class of vulnerabilities documented in this report.
  • ☐Establish a recurring MCP server vulnerability monitoring workflow, tied to your existing CVE tracking process, so that newly disclosed flaws in this layer trigger re-assessment of deployed agent toolchains within a defined SLA.

What to watch next

Adversa AI has signaled ongoing audit activity across MCP server implementations, and the Deadbugz campaign suggests active exploitation interest in this vulnerability class. Compliance teams should monitor whether any of the three named CVEs attract CISA Known Exploited Vulnerability designations, which would trigger mandatory remediation timelines for organizations subject to federal contract requirements. The OWASP GenAI MCP server security baseline and the MCP Project sandboxing guidance are both live reference points that regulators and auditors are beginning to cite as minimum standards, and teams that have not yet mapped controls against those baselines should prioritize that gap before the next audit cycle.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Powered by Buttondown.

Related Coverage

Enforcement2026-09-04

SSH MCP Command Classification Flaw Breaks Human Approval Gate Assumptions

A critical advisory has identified a flaw in an SSH MCP server implementation where a command could be classified as safe while the remote shell executed a different, more privileged command. The vulnerability breaks read-only workflow assumptions that enterprise approval gates depend on. Compliance teams are advised to treat command classification, server provenance, and approval workflows as controls requiring independent validation.

Standards2026-09-10

CSA Sets MCP Authentication Controls as Baseline Agent Security Requirement

The Cloud Security Alliance published updated guidance establishing that MCP server authentication flows must be treated as security-critical control points in enterprise agent deployments. The guidance requires authenticated remote server connections using OAuth 2.1 with PKCE and mandates server metadata validation before any authentication begins. Weak server discovery and uncritical trust in server-provided endpoints are identified as the primary attack vectors enabling metadata manipulation and unauthorized tool interactions.

Research2026-09-02

MCP Server Audit Finds Context Injection Across 19 Servers, Including Active Prompt Injection in Context7

Digital Applied audited 19 MCP servers and found that tool outputs routinely inject unexpected instructions into agent context, with a specific prompt injection issue disclosed in Context7. The audit concludes that enterprises cannot treat MCP server outputs as trusted data by default. Pre-onboarding review and adversarial testing of tool servers are identified as missing controls in most enterprise agent governance programs.