MCP security issues, October 2026
Every field below comes from a primary source: the GitHub Security Advisory (GHSA) API, OSV.dev, NVD, or a project's own changelog. Anything we could not find there is marked not confirmed. We did not run any exploit. This is not a security audit.
Last checked 2026-10-23 08:20 CDT. Method: how we check advisories.
Advisories published on listed servers in October
23 advisories were published in October 2026 across 6 listings: Chrome DevTools MCP (Google), Excel, Kubernetes (Flux159), Serena, Basic Memory, GitLab (zereight). For each one, the last columns show whether the version we tested is in the advisory's stated range, exactly as on the listing page. Dates are the repository advisory's published date. Only advisories published 2026-10-01 to 2026-10-31 are counted.
October advisories (23): 3 in range, 20 not in range, 0 not applicable, 0 with no stated range.
Results across this page (25 advisory results, 2 listings not checked): 3 in range, 21 not in range, 1 not applicable (manual review), 0 with no stated range, 2 listings not checked (remote-only). This is more than 23 because the Other listings table adds 2 older advisory results that apply to listings outside October's list (published before October, or under a manual override).
| Listing | Advisory | Severity (GitHub repo advisory) | Version range in advisory | Fixed in | Published | Tested version | Checked |
|---|---|---|---|---|---|---|---|
| Chrome DevTools MCP (Google) | GHSA-xfxg-8r4q-wj4v Service-worker initiated fetches bypass chrome-devtools-mcp global URL allowlist/blocklist | Medium 4.7 | >=1.2.0, <= 1.4.0 | Fixed in 1.4.0 | 2026-10-22 | Tested version 1.11.0 is not in the affected range of GHSA-xfxg-8r4q-wj4v. | 2026-10-23 |
| Chrome DevTools MCP (Google) | GHSA-5hw5-4q87-m6x9 MCP roots bypass via extension-rewritten symlink output path | Medium no score | >= 1.1.0, <= 1.4.0 | Fixed in 1.5.0 | 2026-10-22 | Tested version 1.11.0 is not in the affected range of GHSA-5hw5-4q87-m6x9. | 2026-10-23 |
| Excel | GHSA-69rc-6f6g-43xj import_workbook checks only cell formulas, not names or rules | Medium no score | >= 1.0.0, <= 1.1.1 | Fixed in 1.1.2 | 2026-10-08 | Tested version 2.2.2 is not in the affected range of GHSA-69rc-6f6g-43xj. | 2026-10-23 |
| Excel | GHSA-frr9-2j4w-q923 Formula safety check bypass: external workbook references and blocked functions still accepted | Low no score | >= 1.0.0, <= 1.1.1 | Fixed in 1.1.2 | 2026-10-08 | Tested version 2.2.2 is not in the affected range of GHSA-frr9-2j4w-q923. | 2026-10-23 |
| Excel | GHSA-99mr-c7r6-xhrc import_workbook lets external links, connections and unsafe hyperlinks into the workspace | Medium 5.4 | >= 1.0.0, <= 1.1.2 | Fixed in 2.0.0 | 2026-10-10 | Tested version 2.2.2 is not in the affected range of GHSA-99mr-c7r6-xhrc. | 2026-10-23 |
| Excel | GHSA-jf2g-fjwq-rjr6 A highly compressed workbook (zip bomb) can exhaust the server's memory | Medium 6.5 | >= 1.0.0, <= 1.1.2 | Fixed in 2.0.0 | 2026-10-10 | Tested version 2.2.2 is not in the affected range of GHSA-jf2g-fjwq-rjr6. | 2026-10-23 |
| Excel | GHSA-wgvf-cmgr-7573 Network (UNC) and device paths are opened, leaking NTLM credentials on Windows | Medium 5.4 | >= 1.0.0, <= 1.1.2 | Fixed in 2.0.0 | 2026-10-10 | Tested version 2.2.2 is not in the affected range of GHSA-wgvf-cmgr-7573. | 2026-10-23 |
| Excel | GHSA-w7wm-p57p-8q22 Formula safety check misses Excel 4.0 macro functions | Medium 5.4 | >= 1.0.0, <= 1.1.2 | Fixed in 2.0.0 | 2026-10-10 | Tested version 2.2.2 is not in the affected range of GHSA-w7wm-p57p-8q22. | 2026-10-23 |
| Excel | GHSA-mvpx-mwxr-g2f5 read_vba can hang or exhaust memory on a malformed VBA project | Low 3.3 | >= 1.1.0, <= 1.1.2 | Fixed in 2.0.0 | 2026-10-10 | Tested version 2.2.2 is not in the affected range of GHSA-mvpx-mwxr-g2f5. | 2026-10-23 |
| Excel | GHSA-5p2h-j6m4-5fm2 A 295 KB workbook still exhausts memory on the full-parse path, because the new guard bounds bytes rather than cells | Medium 5.5 | >= 2.0.0, <= 2.2.1 | Fixed in 2.2.2 | 2026-10-21 | Tested version 2.2.2 is not in the affected range of GHSA-5p2h-j6m4-5fm2. | 2026-10-23 |
| Kubernetes (Flux159) | GHSA-6963-p4fp-2wxw / CVE-2026-104776 kubectl_patch is missing the remote-transport path guard applied to every sibling tool, allowing server-side arbitrary file read via patchFile | High 7.1 | <= 4.1.0 | Fixed in >= 4.1.1 | 2026-10-02 | Tested version 4.1.9 is not in the affected range of GHSA-6963-p4fp-2wxw. | 2026-10-23 |
| Serena | GHSA-pp6p-xvxf-8hhx Remote Code Execution via insecure pickle deserialization of LSP symbol cache (malicious repository → RCE on project activation) | High 8.8 | <= 1.7.1 | Fixed in 2.0.0 | 2026-10-14 | Tested version 2.1.0 is not in the affected range of GHSA-pp6p-xvxf-8hhx. | 2026-10-23 |
| Basic Memory | GHSA-4gfv-c2mm-mvj2 DNS rebinding lets a web page find, exfiltrate, and delete private notes via the unauthenticated MCP SSE transport, bypassing the documented localhost mitigation | High no score | < 0.24.0 | Fixed in 0.24.0 | 2026-10-22 | Tested version 0.23.2 is in the affected range of GHSA-4gfv-c2mm-mvj2. | 2026-10-23 |
| Basic Memory | GHSA-pqm2-2wxw-p5hx Path validation follows server symlinks, letting project names probe the server filesystem | Low no score | < 0.24.0 | Fixed in 0.24.0 | 2026-10-22 | Tested version 0.23.2 is in the affected range of GHSA-pqm2-2wxw-p5hx. | 2026-10-23 |
| GitLab (zereight) | GHSA-qcj2-qcc2-5fg4 Project Scope Authorization Bypass | High 8.1 | >= 2.1.58, <= 2.2.5 | Fixed in 2.2.6 | 2026-10-14 | Tested version 2.3.6 is not in the affected range of GHSA-qcj2-qcc2-5fg4. | 2026-10-23 |
| GitLab (zereight) | GHSA-g4cw-m236-q72h Session IDs are logged in plaintext and MCP OAuth sessions are not bound to their owner | Low 3.3 | >= 2.0.8, <= 2.2.6 | Fixed in 2.3.0 | 2026-10-14 | Tested version 2.3.6 is not in the affected range of GHSA-g4cw-m236-q72h. | 2026-10-23 |
| GitLab (zereight) | GHSA-5w3p-qj7g-79v5 OAuth callback proxy lets any registered client receive a victim's GitLab tokens | High 8.1 | >= 2.1.4, <= 2.2.6 | Fixed in 2.3.0 | 2026-10-14 | Tested version 2.3.6 is not in the affected range of GHSA-5w3p-qj7g-79v5. | 2026-10-23 |
| GitLab (zereight) | GHSA-vhp9-2xfv-rrfv download_attachment overwrites files in the working directory, including in readonly mode | High 7.5 | >= 1.0.77, <= 2.2.6 | Fixed in 2.3.0 | 2026-10-14 | Tested version 2.3.6 is not in the affected range of GHSA-vhp9-2xfv-rrfv. | 2026-10-23 |
| GitLab (zereight) | GHSA-ffr3-5f57-gf93 Project allowlist bypass through target_project_id and work item note emoji tools | Medium 5.4 | >= 1.0.77, <= 2.2.6 | Fixed in 2.3.0 | 2026-10-14 | Tested version 2.3.6 is not in the affected range of GHSA-ffr3-5f57-gf93. | 2026-10-23 |
| GitLab (zereight) | GHSA-64g9-hrwx-9g6m Local OAuth callback server returns GitLab tokens to any local caller | Medium 6.6 | >= 2.0.11, <= 2.2.6 | Fixed in 2.3.0 | 2026-10-14 | Tested version 2.3.6 is not in the affected range of GHSA-64g9-hrwx-9g6m. | 2026-10-23 |
| GitLab (zereight) | GHSA-3gfg-wh5g-cf74 GITLAB_TOOL_POLICY_HIDDEN makes tools from disabled toolsets callable | Medium 4.2 | >= 2.1.0, <= 2.2.6 | Fixed in 2.3.0 | 2026-10-14 | Tested version 2.3.6 is not in the affected range of GHSA-3gfg-wh5g-cf74. | 2026-10-23 |
| GitLab (zereight) | GHSA-2jv7-p2g4-9f2h GITLAB_OAUTH_ALLOWED_GROUPS is only checked at OAuth code exchange | Medium 4.3 | >= 2.1.19, <= 2.2.6 | Fixed in 2.3.0 | 2026-10-14 | Tested version 2.3.6 is not in the affected range of GHSA-2jv7-p2g4-9f2h. | 2026-10-23 |
| GitLab (zereight) | GHSA-5xhm-p3jx-2fmc gitlab_api_request: project allowlist is silently skipped for any GitLab API path that has no parseable project ID | Medium 5.4 | >= 2.2.5, <= 2.3.6 | Fixed in 2.3.7 | 2026-10-22 | Tested version 2.3.6 is in the affected range of GHSA-5xhm-p3jx-2fmc. | 2026-10-23 |
Other listings: earlier advisories, manual reviews and listings not checked
Listings with an advisory outside October whose range includes the version we tested, advisories corrected by manual review, and listings we could not check.
| Listing | Result | Detail | Checked |
|---|---|---|---|
| Kubernetes (Flux159) | Not in range | Tested version 4.1.9 is not in the affected range of GHSA-wmg3-h8mf-wgvr. | 2026-10-23 |
| ScrapingBee MCP (official, remote) | Not checked | Not checked (remote-only): hosted endpoint, version unknown. | not checked |
| Vercel MCP (official, remote) | Not checked | Not checked (remote-only): hosted endpoint, version unknown. | not checked |
| Kubernetes (Python) | Not applicable | 1 Critical advisory (GHSA-wmg3-h8mf-wgvr) names this PyPI package, but its fix and references belong to the npm package Flux159/mcp-server-kubernetes. PyPI only has 0.1.0–0.1.6, so we marked it not applicable. Evidence: issue 328, PR 329, commit d7890f5, tag 3.9.0, PyPI release history. | 2026-10-23 |
SSRF in Laravel MCP (laravel/mcp)
Status: confirmed from the vendor's GitHub advisory GHSA-m25c-38v7-94p8, published 2026-10-21. Severity: 4.8 Medium (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N), scored by the vendor. No CVE is assigned and NVD has no score. Affected versions: 0.8.0 up to, but not including, 1.1.0. Fixed in: 1.1.0 and 0.9.7.
The laravel/mcp client's OAuth discovery didn't check that the authorization server it found was trusted, so an unauthenticated request to the connect route could make the app run OAuth discovery against another host and leak client credentials to it (CWE-918). Mitigation: upgrade to 1.1.0 or 0.9.7; until then, turn off the MCP client OAuth connect and callback routes. Not a TestedMCP listing.
claude -p and project .mcp.json servers
Status: changelog-documented, no advisory. No CVE or CVSS score. Two entries in the official Claude Code CHANGELOG:
- 2.1.238: project
.mcp.jsonheadersHelperand inline MCP servers in project or--add-diragent files now require that folder's trust dialog to have been accepted, also underclaude -p. - 2.1.296: fixed headless sessions starting a folder's
.mcp.jsonor plugin MCP server that was switched off for that folder, after changing directory or reloading plugins.
The broad claim that claude -p starts every .mcp.json server with no prompt at all is unconfirmed. Mitigation: update Claude Code to 2.1.296 or later, and don't run claude -p in repositories you don't trust. Claude Code is a client, not a listed server.
Reported but unconfirmed
- OpenCode MCP OAuth bug, reported as CVSS 9.8: no primary advisory matches this claim as of 2026-10-23.
OpenCode's published advisories (anomalyco/opencode, formerly sst/opencode; GitHub and OSV databases), none about MCP OAuth: GHSA-632h-h47v-g4x4 (cross-site server upgrade request can install packages; CVSS 3.1 7.5, maintainer-scored; published 2026-09-24), GHSA-vxw4-wv6m-9hhh / CVE-2026-22812 (CVSS 8.8; January 2026), GHSA-c83v-7274-4vgp / CVE-2026-22813 (rated critical, no score; January 2026). NVD also lists CVE-2026-88624, a path-validation flaw in Worktree.remove (9.1 from a secondary scorer, published 2026-09-22), not about OAuth.
What we did not verify
- OpenCode: a private, unpublished advisory would not show up in these APIs.
- Claude Code: we did not test the
claude -pbehaviour. - Laravel MCP: only the vendor's score exists.
- Listings: NVD was not checked per listing; dependencies were not scanned; remote-only listings were not checked.