Analysis · guidance · security research
MCPwatch Blog
Source-linked MCP security analysis, research, incident reports, and operator guidance.
Latest reports
Seven reports per page with crawlable archive links.
-
CVE-2026-15829: MCP Toolbox BigQuery Forecast Query Boundary Bypass
CVE-2026-15829 affects MCP Toolbox for Databases 0.13.0 through 1.3.0. Review the BigQuery forecast query boundary bypass, patch, and defenses.
-
CVE-2026-54549: meta-ads-mcp SSRF in upload_ad_image Fetch
CVE-2026-54549 affects meta-ads-mcp through the upload_ad_image MCP tool, which fetches a caller-supplied image_url with no host or IP validation when the server is exposed over the documented streamable-http…
-
CVE-2026-44653: LibreChat MCP Views Expose Decrypted Secrets
CVE-2026-44653 affects LibreChat through shared MCP server views that can expose decrypted administrator-managed secrets. The fixed boundary is 0.8.4.
-
CVE-2026-15583: Grafana MCP Fixes Credentialed SSRF
CVE-2026-15583 affects Grafana MCP before 0.17.1 through credentialed SSRF via X-Grafana-URL. Review the fixed boundary and exposure conditions.
-
CVE-2026-54449: LangBot MCP Authenticated RCE
CVE-2026-54449 covers authenticated command execution through LangBot MCP configuration. Review the affected range and deployment conditions.
-
CVE-2026-58500: MCP Appium Fixes XSS in Locator Generator UI
A high-severity XSS in MCP Appium’s createLocatorGeneratorUI lets attacker-controlled mobile-app element attributes drive arbitrary tool execution through the MCP-UI resource. Review the affected versions, fix, and exposure conditions.
-
Three MCP Python SDK CVEs Fix Session and Origin Boundaries
Three MCP Python SDK CVEs address HTTP session ownership, experimental task isolation, and WebSocket origin validation. Review the exact conditions.