CVE-2026-75130: A CVSS 9.0 MCP Bug With No Documented Fix
What happened
Digital Applied published An MCP Server Bug Scores 9.0. No Fix Is Documented, detailing CVE-2026-75130, a prompt injection vulnerability in the Context7 MCP server through version 2.1.2. Context7 is a tool server used by AI coding agents to pull in live documentation and context during development workflows. The vulnerability allows content served through the MCP connection to bypass agent instructions and redirect agent behavior without user awareness. With a CVSS score of 9.0, the flaw ranks among the most severe in the growing catalog of MCP server security disclosures that compliance teams have been tracking through 2026. Critically, no vendor remediation is on record, which means enterprises cannot resolve their exposure through a standard patch-and-retest cycle.
Why it matters
- ·The absence of a documented fix means that standard patch management processes cannot close this exposure. Enterprises using Context7 must treat the server as a hostile input source and apply compensating controls, such as agent output review gates or tool suspension, until remediation is confirmed.
- ·This vulnerability fits a documented pattern of agentic AI trust boundary failures where tool-server content is implicitly trusted by connected agents. Compliance teams that have not established a content-sanitization or isolation requirement for MCP server onboarding now face an unmitigated supply chain risk in their coding agent workflows.
- ·The disclosure creates a vendor monitoring obligation that most enterprises have not formalized. Without a vendor remediation SLA or a defined process to track fix status for agentic tooling dependencies, organizations have no systematic way to know when, or whether, it is safe to restore Context7 to production use.
Governance controls affected
What to do now
- ☐Audit your approved MCP server inventory to confirm whether Context7 is active in any coding agent environment, and suspend its use until a vendor fix is documented and verified.
- ☐Require compensating controls, such as agent output review or sandboxed execution, for any MCP server that ingests external content before restoration to production.
- ☐Establish a remediation SLA policy for agentic tooling dependencies that specifies a maximum window for vendor response before mandatory suspension.
- ☐Update your MCP server onboarding checklist to classify tool servers delivering third-party or web-sourced content as elevated risk, requiring additional security review.
- ☐Add CVE-2026-75130 to your vulnerability tracking register and assign an owner to monitor Context7's public remediation status on a defined cadence.
What to watch next
Compliance teams should monitor Context7's repository and vendor communications for any patch release, and should not restore production use without independent verification that unsanitized content paths are closed. The broader MCP server vulnerability pattern is attracting attention from standards bodies, and guidance from OWASP's GenAI working group or similar organizations may set a more formal baseline for tool-server content handling requirements. Teams building or updating agentic AI procurement standards should track whether regulators begin citing specific CVEs in enforcement actions, a development that would accelerate the need for documented MCP server intake policies.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- AI agents this week destroyed backups at machine speed, leaked sensitive data without developer approval, and drew federal scrutiny that may extend liability to every enterprise deploying them.1 Oct
- A vulnerability that bypasses approved-plugin controls, new criminal liability for executives, and a landmark safety-disclosure framework all point to one conclusion: AI systems are outpacing the controls organizations have built around them.23 Sept
Free every Thursday. Unsubscribe anytime.