Twenty-Two MCP CVEs Exposed the Permission Boundary

The most useful AI development in the latest 24-hour window was not a model launch. It was a concentrated set of vulnerability records showing what happens when agent tools inherit command, file and network authority without narrow boundaries.

The US National Vulnerability Database published 80 CVE records between 8 August 2026 at 11:16 Asia/Tehran and 9 August 2026 at 11:16 Asia/Tehran. A text classification of their English descriptions finds 22 records that explicitly name MCP projects: nine command-injection cases, eleven path-traversal cases and two server-side request-forgery cases. That count comes from the dated NVD 2.0 API window published on 8–9 August, not from a claim that NVD maintains an official “MCP” category.

The burst is not evidence that the Model Context Protocol itself failed, that all MCP servers are unsafe or that 22 zero-days suddenly appeared. Several underlying reports and fixes pre-date this window by months. The in-window event is the publication of the CVE records. The operational lesson is still current: a tool's risk is set by the authority of its process and environment, not by the convenience of its protocol.

The compact read:

• Nineteen of the 22 MCP descriptions require or describe local access; two describe remote initiation, while one uses an adjacent-network vector.
• “Local” is not synonymous with harmless when an MCP process can read repositories, invoke shells, alter files or reach internal services.
• Maintainer evidence ranges from patched releases to open reports without a merged fix, so teams need version and reachability evidence rather than a flat blocklist.
• Separate records for Flowise, Lollms and two Linux subsystems widen the same question from agent tools to web surfaces and cloud infrastructure.

The publication date is not the discovery date

The chronology changes the correct response. A newly published database record can describe an already patched flaw, an unresolved report or a code change that shipped long before a CVE identifier became visible.

For example, NVD published CVE-2026-19266 on 8 August for command injection in Context Engine's Git-diff path. The maintainer's fix commit is dated 26 April, and release 1.9.1 shipped on 15 July. The new event is therefore the record, not a new August patch.

The same distinction applies to CVE-2026-10595, published on 9 August. NVD says Lollms 2.1.0 allowed unauthenticated file reads through a path-traversal flaw and identifies version 3 as the resolution. The project's containment fix was committed on 1 June. A responsible brief separates those dates rather than presenting old remediation as a fresh incident.

Command execution was the first recurring boundary

Nine MCP records describe command injection. The affected functions differ—Git review, usage queries, PDF loading, slide assets, memory hooks, model commands, chip-design tasks and database type generation—but the structural mistake is similar. Untrusted tool arguments cross into a command-capable process without a sufficiently narrow argument grammar or execution boundary.

Context Engine's patch shows the shape of a useful correction. It added explicit validation for Git references and workspace-relative path patterns, bounded context values, disabled shell execution in the process spawn and added tests for shell metacharacters and option-like paths.

The operational check is not “do we use MCP?” It is:

• Which tool handlers can create a process or call an interpreter?
• Which arguments are chosen directly or indirectly by model output?
• Are commands represented as fixed executables plus validated argument arrays?
• Can option injection change the meaning of an otherwise allowed command?
• What operating-system identity, filesystem scope and network access does the child process inherit?

An agent that can propose a Git comparison does not need general shell authority. A document tool that can open one approved file does not need to construct arbitrary command lines. The five output-validation gates make the same separation: generated intent remains untrusted until deterministic policy validates the proposed action.

Path traversal turned workspace convenience into ambient file authority

Eleven records describe path traversal. The projects cover journey files, generated documentation, memory banks, skills, approvals, design assets, canvases and workflow outputs. Most descriptions label the attack local.

An MCP server commonly runs beside source code, credentials, configuration, notes or generated artefacts. If a caller-controlled path can escape an intended directory, a “local” tool call may read, overwrite or delete material beyond the task's authorised workspace. The right boundary is a resolved path contained inside an approved root, followed by file-type, operation and size policy. Removing visible parent-directory sequences is not enough when encoding, symlinks or platform-specific paths can alter the resolved destination.

Two maintainer records make the remediation history concrete. Skill Ninja 0.1.1, released on 20 May, says it restricted arbitrary workspace-path read, write and delete operations to trusted roots; NVD published the associated CVE-2026-19328 on 9 August. Spec Workflow's issue 220 was opened on 25 April, and pull request 222 merged on 4 May with category validation and safe path joining; NVD published CVE-2026-19336 in this window.

Those are patch histories, not proof about every installation. Teams still need the exact package, commit, container or bundled copy that production runs. The dependency-to-release method in our AI dependency inventory guide is designed for that affected-or-not-affected decision.

SSRF made a fetch tool part of the private network

The two MCP SSRF records show why a tool named “read webpage” or “read resource” can carry more authority than its interface suggests. Server-side request forgery makes the server choose the network position from which the request is sent. That can expose loopback services, private addresses or cloud metadata endpoints that the original caller could not reach directly.

The mcp-google-search report remains open, while its linked remediation pull request was also open when checked. Its report describes a webpage reader passing a caller-selected URL to an HTTP client without private-address, DNS-resolution or redirect checks. NVD published CVE-2026-19337 on 9 August, but its description labels the required approach local.

The Alibaba Cloud DataWorks MCP report says a resource handler fetched any URI beginning with HTTP and returned the response body. The issue was open when checked, and NVD's CVE-2026-19339 record describes remote initiation. Neither record proves access to a particular production network. Both identify the control that must exist: destination policy enforced after DNS resolution and again across redirects, backed by network egress rules that deny metadata and private services by default.

Flowise and Lollms widened the agent surface

Two records outside the explicit MCP count reinforce the same boundary. CVE-2026-67620, published on 8 August, says Flowise through 3.1.4 omitted Oracle Cloud and Alibaba Cloud metadata addresses from an SSRF deny list. The source VulnCheck advisory says crafted fetch-links requests could reach those endpoints, with unauthenticated access possible where a public chatflow exposed URL-fetching nodes. The NVD record does not name a fixed version, so the safe response is feature isolation or verified vendor remediation—not an inferred upgrade.

Lollms illustrates the file side. Its vulnerable catch-all route joined user-controlled URL input into a filesystem path. The June patch resolved the requested path and rejected any result outside the intended frontend directory. Both cases are ordinary web-security failures in AI-labelled products. Agent features do not suspend established controls; they increase the importance of applying them to every model-triggered fetch and file operation.

Cloud substrate records kept infrastructure in scope

The window also contained two Linux records relevant to cloud operators. CVE-2026-68081 describes a resolved KVM nested-virtualisation path that could leak pinned pages when a nested VM entry failed and was retried. CVE-2026-68082 describes two unsafe Ceph decoding operations through which a malicious or compromised storage daemon could trigger out-of-bounds reads in a kernel client.

These records do not establish a cloud outage, active exploitation or exposure at a named provider. They do show why an AI service's risk inventory must extend below the model and tool server. Virtualisation, storage clients, base images and kernels remain part of the deployed outcome even when the product discussion concentrates on prompts and agents.

[Finance](/industries/finance) teams should map authority before capability

In a financial workflow, the dangerous question is rarely whether an assistant can draft an answer. It is whether the surrounding tool process can reach a ledger, export customer data, call an internal service, change a repository or initiate a payment-adjacent action.

Start with an authority map for every agent tool:

• filesystem roots and allowed operations;
• fixed executables and argument schemas;
• outbound domains, resolved address ranges and redirect policy;
• database roles and row or tenant scope;
• secrets available to the process and its children;
• maximum transaction, message or batch size;
• human approval points and independent outcome confirmation; and
• kill, rollback and manual-continuity paths.

Treat a tool description as documentation, not enforcement. Put denials in the operating system, container, network, identity layer and application policy. The control-boundary analysis in our AI transparency and tool-trust brief explains why a model-facing schema cannot carry the entire security contract.

What to do in the next 48 hours

Teams do not need to block every MCP server because 22 records appeared. They need to make exposure answerable.

• Export the installed MCP and agent-tool inventory with exact versions, commits and owners.
• Match the 22 identifiers, then verify presence and reachability rather than stopping at a name match.
• Disable unused command, file and fetch tools before testing compensating controls.
• Constrain child processes, workspace roots and network egress outside the model.
• Re-test path resolution across encoding, symlink, redirect and platform-specific cases.
• Rotate credentials if logs show an affected path reached secrets or metadata; do not rotate solely from the existence of a CVE.
• Preserve request, tool arguments, policy decision, process identity, destination and outcome for incident review.
• Re-enable only after the deployed artefact and boundary tests support the decision.

Limits and what to watch next

The 22-record count is a classification of NVD descriptions in one 24-hour slice. It is not a vulnerability rate, a random sample of MCP servers or evidence that MCP projects are less secure than other software. Many records came from one CNA, many projects are small, and disclosure visibility can cluster when a researcher submits related findings together. NVD severity and access wording should be re-evaluated against the actual deployment.

Watch for maintainer responses on the open SSRF reports, fixed-version guidance for Flowise, downstream advisories from package distributors and any evidence of exploitation from trusted incident responders. Also watch whether future MCP implementations reduce ambient authority through root containment, fixed command grammars and default-deny egress.

The durable lesson is not “avoid MCP”. It is that every convenient tool interface crosses into a process with real authority. Inventory that authority, narrow it before the model asks, validate every argument at the boundary and record the outcome independently. Protocol adoption can move quickly; permission design must move first.