Ten MCP Server CVEs Drop in a Single Day

The Model Context Protocol — the open standard for letting AI assistants invoke external tools — picked up ten new CVEs in NVD on August 9, 2026. All ten affect distinct open-source MCP server implementations. The vulnerability classes across all ten: server-side request forgery (SSRF) and path traversal. That split is not coincidence. It is the signature of a developer community building fast and reviewing security later.

The batch

SSRF group — URL-handling code in tool-facing handlers that pass caller-supplied URLs directly to HTTP clients without validation:

• CVE-2026-19369 (CVSS 5.3, medium) — SSRF via imageUrl in the add_attachment_from_public_url handler of KS-GEN-AI/jira-mcp-server 0.2.0; local access required; vendor has not responded to disclosure.
• CVE-2026-19367 (CVSS 6.3, medium) — SSRF via Source in read_range_config within NocteDefensor/LudusMCP 1.0.24; remotely exploitable; unpatched.
• CVE-2026-19340 (CVSS 6.3, medium) — SSRF via the url parameter in the Webhooks API of anubissbe/ProjectHub-Mcp 5.0.0; remotely exploitable; unpatched.
• CVE-2026-19339 (CVSS 6.3, medium) — SSRF via request.params.uri in the ReadResourceRequestSchema handler of aliyun/alibabacloud-dataworks-mcp-server 1.0.43; remotely exploitable; unpatched.
• CVE-2026-19337 (CVSS 5.3, medium) — SSRF via url in the read_webpage tool of adenot/mcp-google-search 0.3.1; local access required; patched in commit f071d491.

Path traversal group — file-path arguments that escape the intended working directory when passed unsanitized:

• CVE-2026-19368 (CVSS 3.3, low) — path traversal via file_path/file_paths in PV-Bhat/gemsuite-mcp 1.0.0; local; unpatched.
• CVE-2026-19338 (CVSS 5.3, medium) — path traversal via folder/name in the generate_mermaid_markdown tool of automateyournetwork/MCPyATS 0.1.4; local; unpatched.
• CVE-2026-19336 (CVSS 5.3, medium) — path traversal via categoryName in ApprovalStorage.createApproval within Pimzino/spec-workflow-mcp 2.2.6; local; patched in version 2.2.7.
• CVE-2026-19335 (CVSS 5.3, medium) — path traversal via skillName in getSkillVersionsDir within Jane-xiaoer/skill-vision-control 1.3.0; local; unpatched.
• CVE-2026-19365 (CVSS 5.3, medium) — path traversal via output_path in the upscale_images tool of Ichigo3766/image-gen-mcp 0.1.0; local; unpatched.

Most of these were reported through coordinated disclosure. Most maintainers had not responded as of the NVD filing date. Two carry patches already.

Why this pattern

SSRF and path traversal are a decade older than MCP. They appear in every new generation of tooling — not because the bugs are newly discovered, but because each wave of developers inherits input-validation problems without inheriting the institutional memory of why they matter. An SSRF in an MCP server’s URL-fetching handler can let an attacker probe internal services, reach cloud metadata endpoints (the AWS instance metadata service at 169.254.169.254 is the standard illustration), or exfiltrate credentials — all routed through what the network sees as a trusted server-side call. A path traversal in a file-handling tool can expose arbitrary host filesystem content to anything the server has access to.

The MCP ecosystem is young and largely composed of single-maintainer library projects. That is a structural reality, not a criticism. But it does mean that the standard dependency audit security teams apply to open-source libraries should now extend to MCP servers running inside AI-integrated pipelines. An MCP server that a language model can invoke has the same attack surface as any other backend service — it just arrived in the environment more quietly, often installed by a developer exploring a new feature rather than by the security team reviewing a deployment.

The same dynamic played out with npm packages in the late 2010s, with PyPI packages more recently — as Arch Linux found last year when malicious AUR takeovers and as Claude demonstrated when a security evaluation accidentally published malware to PyPI. The attack surface travels with the tooling.

What to do

For any of the named servers, check the NVD entry linked above for affected version and patch status. For unpatched servers still in use, consider network-layer controls: restrict outbound connections from MCP servers to only the destinations they legitimately need — no internal subnets, no cloud metadata ranges — and restrict file-access paths via OS-level controls rather than relying on application-layer validation. Review which tools are exposed to the LLM layer. If a tool has no legitimate need for arbitrary URL fetch or filesystem write access, revoke it at the configuration level.

More broadly: before deploying a third-party MCP server, treat it like any other open-source dependency. Review its security disclosure history. Run it in a sandboxed environment with constrained network and filesystem permissions. The MCP ecosystem will develop its own security posture over time; until it does, the operator carries that review burden.

Analysis

Ten CVEs in a single NVD batch is not evidence of an unusually insecure protocol. It is evidence of a research community catching up to a fast deployment curve — the same curve ESET’s H1 2026 threat report documented when it tracked attackers weaponizing AI platform skills earlier this year. The bugs here are real but elementary. The pattern will repeat as MCP server adoption widens — the only question is whether the next batch surfaces through CVEs and responsible disclosure, or through breach reports after the fact.