AI Governance Institute
← News
Research2026-08-26

CVE-2026-75130: A CVSS 9.0 MCP Bug With No Documented Fix

What happened

Digital Applied published An MCP Server Bug Scores 9.0. No Fix Is Documented, detailing CVE-2026-75130, a prompt injection vulnerability in the Context7 MCP server through version 2.1.2. Context7 is a tool server used by AI coding agents to pull in live documentation and context during development workflows. The vulnerability allows content served through the MCP connection to bypass agent instructions and redirect agent behavior without user awareness. With a CVSS score of 9.0, the flaw ranks among the most severe in the growing catalog of MCP server security disclosures that compliance teams have been tracking through 2026. Critically, no vendor remediation is on record, which means enterprises cannot resolve their exposure through a standard patch-and-retest cycle.

Why it matters

  • ·The absence of a documented fix means that standard patch management processes cannot close this exposure. Enterprises using Context7 must treat the server as a hostile input source and apply compensating controls, such as agent output review gates or tool suspension, until remediation is confirmed.
  • ·This vulnerability fits a documented pattern of agentic AI trust boundary failures where tool-server content is implicitly trusted by connected agents. Compliance teams that have not established a content-sanitization or isolation requirement for MCP server onboarding now face an unmitigated supply chain risk in their coding agent workflows.
  • ·The disclosure creates a vendor monitoring obligation that most enterprises have not formalized. Without a vendor remediation SLA or a defined process to track fix status for agentic tooling dependencies, organizations have no systematic way to know when, or whether, it is safe to restore Context7 to production use.

Governance controls affected

AGT-002Agent Prompt Injection DefenseAGT-019AI Tool and Plugin Supply Chain Risk AssessmentSEC-001Prompt Injection PreventionPRC-008Vendor Model Update Disclosure and Re-Assessment ProtocolAGT-008Agent Environment Isolation

What to do now

  • ☐Audit your approved MCP server inventory to confirm whether Context7 is active in any coding agent environment, and suspend its use until a vendor fix is documented and verified.
  • ☐Require compensating controls, such as agent output review or sandboxed execution, for any MCP server that ingests external content before restoration to production.
  • ☐Establish a remediation SLA policy for agentic tooling dependencies that specifies a maximum window for vendor response before mandatory suspension.
  • ☐Update your MCP server onboarding checklist to classify tool servers delivering third-party or web-sourced content as elevated risk, requiring additional security review.
  • ☐Add CVE-2026-75130 to your vulnerability tracking register and assign an owner to monitor Context7's public remediation status on a defined cadence.

What to watch next

Compliance teams should monitor Context7's repository and vendor communications for any patch release, and should not restore production use without independent verification that unsanitized content paths are closed. The broader MCP server vulnerability pattern is attracting attention from standards bodies, and guidance from OWASP's GenAI working group or similar organizations may set a more formal baseline for tool-server content handling requirements. Teams building or updating agentic AI procurement standards should track whether regulators begin citing specific CVEs in enforcement actions, a development that would accelerate the need for documented MCP server intake policies.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Powered by Buttondown.

Related Coverage

Research2026-09-11

68 MCP Server CVEs in One Month Expose a Systemic Agent Supply Chain Gap

Adversa AI’s September 7, 2026 roundup identified 68 reportable vulnerabilities across audited MCP servers. Findings included SQL injection, cloud-metadata SSRF, prompt-template injection, and path traversal. The affected implementations are used in enterprise agent deployments, making server security relevant to vendor reviews.

Research2026-09-02

MCP Server Audit Finds Context Injection Across 19 Servers, Including Active Prompt Injection in Context7

Digital Applied audited 19 MCP servers and found that tool outputs routinely inject unexpected instructions into agent context. A specific prompt injection issue disclosed in Context7. The audit concludes that enterprises cannot treat MCP server outputs as trusted data by default. Pre-onboarding review and adversarial testing of tool servers are identified as missing controls in most enterprise agent governance programs.

Standards2026-09-15

Chrome's WebMCP Guidance Sets a Browser-Vendor Baseline for Agent Tool Security

Google Chrome Developers published official WebMCP tool security guidance recommending that enterprises label untrusted content, mark state-changing tools, restrict tool exposure to trusted origins, and require confirmation gates for non-reversible agent actions. The guidance formalizes tool metadata as a governance artifact and distinguishes read-only from consequential tool access. Enterprise compliance teams deploying browser-integrated AI agents now have a named vendor baseline against which their controls will be evaluated.