Five MCP CVEs in one week, sorted by what they give an attacker: secrets (NetLicensing, 9.6), access (Unla), code execution (mac-shell-mcp) and downtime (Python SDK).
Between 11 and 15 October 2026, five CVEs landed against MCP software. They are not one bug class, so it helps to sort them by what an attacker walks away with: stolen credentials, a free pass through the front door, a shell on the host, or a server that falls over.
What an attacker gets
Secrets: NetLicensing MCP (CVE-2026-57496, CVSS 9.6)
Labs64's NetLicensing MCP server (netlicensing-mcp on PyPI) lets an agent manage software licences. The netlicensing_get_product tool drops the caller-supplied product_number into a REST path with no validation. A value such as ../token resolves to the token endpoint, and the response is serialised through the generic wrapper instead of the token-specific one. That skips the redaction that normally masks APIKEY number and SHOP shopURL values.
The attacker needs an authenticated MCP client with a non-administrative API key. The payoff is plaintext tokens, and if one is an administrative token it gives broad read, write and delete access to the NetLicensing account. NVD scores it 9.6 (CWE-22); the advisory text also mentions 8.3, so quote the NVD figure with care. Fixed in 0.1.8. The advisory lists 0.1.5 and earlier as affected, while NVD says "prior to 0.1.8".
Access: AmoyLab Unla (CVE-2026-108865, CVSS 8.2)
Unla is an MCP gateway. Through version 0.10.0 its OAuth2 server never authenticates a resource owner. An unauthenticated attacker can register a client, request a code from /authorize and exchange it at /token. The token opens the OAuth2-protected MCP prefixes, the proxied upstream APIs and the credentials the gateway injects. CWE-287; VulnCheck also rates it 8.8 under CVSS 4.0. NVD names no fixed version, so treat every release up to 0.10.0 as exposed.
For a gateway this is the worst position in the roundup: it hands over not one tool but everything behind the gateway.
Code execution: mac-shell-mcp (CVE-2026-108953, CVSS 7.8)
mac-shell-mcp gates execute_command with a command allowlist. Before 2.0.0 it did not stop shell metacharacters in the arguments, so a permitted command such as pwd with an argument like ; runs forbidden commands as the server user, without the approval step. CWE-78. The advisory says the caller can be an MCP client or a malicious prompt, which makes prompt injection a realistic route. The score is local-vector (7.8 under 3.1, 8.5 under 4.0), but the account that runs the server is usually the developer's own. Fixed in 2.0.0.
Downtime: MCP Python SDK (CVE-2026-109527, CVE-2026-59951)
Two denial-of-service flaws in the official mcp package, both reachable by an unauthenticated network client:
- CVE-2026-109527 (7.5, CWE-770). Before 1.29.1, and 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint and OAuth authorization-server routes buffer whole request bodies with no size cap. A large body uses several times its size in memory and can kill the server. Fixed in 1.29.1 and 2.1.0. Stdio-only servers and servers behind an upstream size limit are not affected.
- CVE-2026-59951 (CVSS 4.0 6.9, CWE-400). From 1.8.0 until 1.30.0, and on 2.x before 2.2.0, stateful Streamable HTTP servers (FastMCP, MCPServer,
StreamableHTTPSessionManager) keep session entries with no idle expiry or count limit. Short, ordinary requests grow memory until restart. Fixed in 1.30.0 and 2.2.0. Stateless HTTP, stdio and SSE are not affected.
To clear both, move to 1.30.0 or later on the 1.x line, or 2.2.0 on 2.x. These are new and separate from the earlier SDK issue we covered, the OAuth credential theft that an issuer fix did not fully close.
Each flaw sorted by what an attacker walks away with.
A checklist for running community MCP servers
- Pin and track versions. Know which MCP servers run, at what version, and subscribe to their advisories. Four of these five fixes are in a point release.
- Treat tool arguments as hostile input. Two of these bugs (path traversal, shell metacharacters) are plain input-validation failures that an agent or a prompt injection can trigger.
- Run with least privilege. Use a non-admin, narrowly scoped API key, and run shell-capable servers as a dedicated low-privilege user or in a container.
- Do not rely on an allowlist alone. Command allowlists need argument handling, not just name matching.
- Keep HTTP-transport servers off open networks. Put them behind a reverse proxy with a request-size limit, authentication and rate limits. Prefer stdio when only one local client needs the server.
- Check your gateway's auth by hand. Try to get a token without logging in. If you can, so can anyone.
- Rotate after exposure. If you ran an affected NetLicensing version, rotate API keys, especially admin ones.
- Watch memory. Alert on steady growth in long-running MCP processes.