Skip to content
NewA calmer, faster ZeroHour
StoryResearchinfo

Researchers release dataset of 24 validated MCP vulnerabilities

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

A paper filters 119 MCP-related CVE records to 24 validated flaws, most rated Critical or High.

Authors of an arXiv paper built a curated Model Context Protocol vulnerability dataset from CVE disclosures. From 119 MCP-related records retrieved through February 2026, filtering produced 24 validated vulnerabilities. They report that 87.5 percent are Critical or High, and that injection plus path traversal account for 66.7 percent. Recurring issues involve input validation, access control, and protocol-level security, illustrated in six case studies. They released the dataset, reproducibility tooling, and a maintenance workflow.

Key facts
  • Filtering of 119 records through February 2026 yielded 24 validated vulnerabilities.
  • Authors say 87.5 percent are Critical or High.
  • Injection and path traversal account for 66.7 percent, according to the authors.
  • A sampled exclusion audit reached 96.7 percent inter-rater agreement.
  • Filtering kept all known high-severity MCP cases from public advisories.
  • The methodology explicitly addresses MCP acronym ambiguity.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

What each outlet adds

beyond the shared facts
  • arXiv cs.CRDataset size, severity mix, attack-type share, and tooling release.
Vendors
Runlayer
Products
Model Context Protocol

Coverage

oldest first · one row per article · UTC
  1. · 5d ago Hacker News · securityFirst report

    MCP Explained walks through the 2025-11-25 protocol and attack cases

    The guide covers JSON-RPC shapes, deprecated batching, and defenses for tool poisoning, shadowing, and injection.

  2. · 3d ago arXiv cs.CR

    Paper builds a 24-case dataset of MCP security vulnerabilities

    Authors say 87.5 percent are Critical or High, and injection plus path traversal account for 66.7 percent.