AI Governance Institute logo
AI Governance Institute

Intelligence for Compliance and GRC Teams

← News
Research2026-08-26

CVE-2026-75130: A CVSS 9.0 MCP Bug With No Documented Fix

What happened

Digital Applied published An MCP Server Bug Scores 9.0. No Fix Is Documented, detailing CVE-2026-75130, a prompt injection vulnerability in the Context7 MCP server through version 2.1.2. Context7 is a tool server used by AI coding agents to pull in live documentation and context during development workflows. The vulnerability allows content served through the MCP connection to bypass agent instructions and redirect agent behavior without user awareness. With a CVSS score of 9.0, the flaw ranks among the most severe in the growing catalog of MCP server security disclosures that compliance teams have been tracking through 2026. Critically, no vendor remediation is on record, which means enterprises cannot resolve their exposure through a standard patch-and-retest cycle.

Why it matters

  • ·The absence of a documented fix means that standard patch management processes cannot close this exposure. Enterprises using Context7 must treat the server as a hostile input source and apply compensating controls -- such as agent output review gates or tool suspension -- until remediation is confirmed.
  • ·This vulnerability fits a documented pattern of agentic AI trust boundary failures where tool-server content is implicitly trusted by connected agents. Compliance teams that have not established a content-sanitization or isolation requirement for MCP server onboarding now face an unmitigated supply chain risk in their coding agent workflows.
  • ·The disclosure creates a vendor monitoring obligation that most enterprises have not formalized. Without a vendor remediation SLA or a defined process to track fix status for agentic tooling dependencies, organizations have no systematic way to know when -- or whether -- it is safe to restore Context7 to production use.

Governance controls affected

SEC-001Adversarial Input and Prompt Injection TestingAGT-010Agent Knowledge Source IntegrityAGT-019AI Tool and Plugin Supply Chain Risk AssessmentSEC-005Supply Chain Security for AI DependenciesPRC-007Vendor Governance Change Monitoring

What to do now

  • ☐Audit your approved MCP server inventory to confirm whether Context7 is active in any coding agent environment, and suspend its use until a vendor fix is documented and verified.
  • ☐Require compensating controls -- such as agent output review or sandboxed execution -- for any MCP server that ingests external content before restoration to production.
  • ☐Establish a remediation SLA policy for agentic tooling dependencies that specifies a maximum window for vendor response before mandatory suspension.
  • ☐Update your MCP server onboarding checklist to classify tool servers delivering third-party or web-sourced content as elevated risk, requiring additional security review.
  • ☐Add CVE-2026-75130 to your vulnerability tracking register and assign an owner to monitor Context7's public remediation status on a defined cadence.

What to watch next

Compliance teams should monitor Context7's repository and vendor communications for any patch release, and should not restore production use without independent verification that unsanitized content paths are closed. The broader MCP server vulnerability pattern is attracting attention from standards bodies, and guidance from OWASP's GenAI working group or similar organizations may set a more formal baseline for tool-server content handling requirements. Teams building or updating agentic AI procurement standards should track whether regulators begin citing specific CVEs in enforcement actions, a development that would accelerate the need for documented MCP server intake policies.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Powered by Buttondown.

Related Coverage

Research2026-08-24

Zero-Click Prompt Injection Escapes Coding Agent Sandbox, Binary Overwritten

Adversa AI's August 2026 security roundup documents a zero-click prompt injection attack against AI coding agents that bypassed terminal sandboxing and overwrote a sandbox helper binary. The research frames coding-agent tooling as a software supply chain component requiring sandbox hardening, binary integrity checks, and explicit approval gates for privileged actions. Compliance teams should treat the findings as a signal to reassess how their agent tooling intake and deployment controls are structured.

Research2026-08-20

Hidden Pull Request Instructions Exploit AI Agents in Azure DevOps MCP

Security researchers at ExploreSec have identified a vulnerability in the Azure DevOps MCP Server that allows attackers to embed malicious instructions inside pull request comments in a form invisible to human reviewers but readable by AI agents. The flaw undermines prompt-injection defenses and code review workflows wherever AI agents are integrated into developer pipelines. Organizations using AI-assisted DevSecOps toolchains are directly exposed.

Enforcement2026-08-21

Critical MCP Atlassian Flaw Enables Arbitrary File Write and Code Execution

Check Point disclosed CVE-2026-27825, a high-severity arbitrary file write vulnerability in MCP Atlassian versions before 0.17.0. An attacker who exploits the flaw can write content to any path accessible by the server process, creating a realistic path to full server compromise. Enterprises running MCP Atlassian in their agent toolchains must patch immediately and restrict server-side file write permissions.