MCP server vulnerabilities in 2026: affected and fixed versions

Updated 2026-11-15

Short answer: between late October and 13 November 2026, Amazon, AWS, Microsoft, IBM, pgEdge and the MCP TypeScript SDK published fixes for flaws in MCP servers and gateways. Every one in the table below has a fixed version. None of them is in CISA's exploited list (catalog of 13 November 2026), and Microsoft marks its MCP Gateway flaw as not exploited. A separate batch of command-injection CVEs in smaller open-source MCP servers, published by NVD on 27 October, names no fixed version.

Fixed versions

What each flaw does and who is exposed

• mcp-gateway-registry, CVE-2026-100307: any signed-in user could send a crafted group import to POST /api/servers/groups/import and make themselves registry administrator. AWS says 1.25.0 (released 27 June 2026) blocks it, but does not remove admin mappings written before the upgrade (AWS).
• mcp-gateway-registry, CVE-2026-125926: a user allowed to register or edit a server could point it at internal addresses, including the cloud instance metadata service, and in some cases read the responses (AWS). Running 1.25.0 to 1.34.0 fixes the first flaw but not this one (GitHub advisory).
• AWS API MCP Server, CVE-2026-125271: denyList and elicitList rules in a custom security policy did not match AWS operations whose names contain consecutive capital letters. AWS says it needs a locally run server with such a policy, and that its remote AWS API MCP Server offering is not affected (GitHub advisory).
• AWS API MCP Server, CVE-2026-115413: with the streamable-http transport and OAuth, a token issued to another app of the same identity provider was accepted. The default stdio transport is not affected (AWS).
• Microsoft MCP Gateway, CVE-2026-109492: "An authenticated attacker could send specially crafted requests over the network to access another user's resources in an affected gateway", such as reading their workload logs (Microsoft). CVSS 8.8.
• IBM ContextForge, CVE-2026-110278 and CVE-2026-110279: the per-server identity propagation setting was ignored when tools were called, and an X-Upstream-Authorization header from the client could replace the credential the gateway holds for an upstream server (IBM).
• pgEdge Postgres MCP Server: a read_only connection could still write when the database role has write rights, through query_database (CVE-2026-126196) or through custom pl-do tools (CVE-2026-126197). sql and pl-func tools are not affected (pgEdge advisories).
• MCP TypeScript SDK, CVE-2026-111770: an HTTP server that reuses one transport or one server instance for several clients could send one client's replies to another. stdio servers and @modelcontextprotocol/sdk 1.26.0 and later are not affected. The advisory says upgrading to 2.3.0 also needs a code change, because the SDK now refuses shared instances (MCP SDK advisory).

October batch: command injection, no fixed version listed

NVD published these on 27 October 2026 from VulnCheck reports. In each one, tool arguments reach a shell, so "prompt-injected agents" can run commands as the user running the MCP server (NVD). NVD names no fixed version for any of them.

Find the MCP servers you have configured (read-only)

MCP clients keep their server list in JSON files:

• Claude Code: ~/.claude.json (local and user scope) and .mcp.json in a project root (Claude Code docs)
• Claude Desktop: ~/Library/Application Support/Claude/claude_desktop_config.json on macOS, %APPDATA%\Claude\claude_desktop_config.json on Windows, ~/.config/Claude/claude_desktop_config.json on Linux (VS Code docs)
• Cursor: ~/.cursor/mcp.json and .cursor/mcp.json in a project (Cursor docs)
• VS Code: .vscode/mcp.json, a workspace-root .mcp.json, and ~/.copilot/mcp-config.json (VS Code docs)

grep -nE '"(command|args|url)"' ~/.claude.json ~/.cursor/mcp.json ~/.copilot/mcp-config.json \
  "$HOME/Library/Application Support/Claude/claude_desktop_config.json" 2>/dev/null
find ~ -maxdepth 4 \( -name .mcp.json -o -path '*/.cursor/mcp.json' -o -path '*/.vscode/mcp.json' \) 2>/dev/null

The grep prints only the command, arguments and URL lines, so API keys in env or headers blocks stay off the screen. Then ask the package manager which version is installed:

pip show awslabs.aws-api-mcp-server mcp-contextforge-gateway 2>/dev/null | grep -E '^(Name|Version)'
uv tool list 2>/dev/null | grep -iE 'mcp|contextforge'
npm ls -g --depth=0 2>/dev/null | grep -i mcp
npm ls @modelcontextprotocol/server
docker image ls | grep -iE 'mcp-gateway|contextforge|mcp'

Compare what they print with the tables above. These commands only read. Nothing in them starts a server.

FixLane runs a read-only MCP server too. Its tools look up programs and CVE ids and return text. They do not run commands on your machine (docs, how to connect it).

Questions

Which mcp-gateway-registry version fixes both 2026 flaws?

1.35.0. Version 1.25.0 fixes the admin escalation CVE-2026-100307, but stays affected by the SSRF flaw CVE-2026-125926 until 1.35.0, according to AWS.

Is the AWS API MCP Server vulnerability exploited?

Neither CVE-2026-125271 nor CVE-2026-115413 is in CISA's exploited list as of its 13 November 2026 catalog. Both are fixed: 1.5.1 for the first, 1.6.0 for the second.

Are MCP servers over stdio affected by the TypeScript SDK flaw?

No. The advisory for CVE-2026-111770 says stdio servers, and servers that build a new instance per call, are not affected. It hits HTTP servers that share one instance between clients.

How do I see which MCP servers my editor runs?

Read the client's config file: ~/.claude.json or .mcp.json for Claude Code, ~/.cursor/mcp.json for Cursor, .vscode/mcp.json or ~/.copilot/mcp-config.json for VS Code, claude_desktop_config.json for Claude Desktop.

Sources

• AWS security bulletin 2026-179-AWS (CVE-2026-100307)
• AWS security bulletin 2026-180-AWS (CVE-2026-125926)
• AWS security bulletin 2026-176-AWS (CVE-2026-125271)
• AWS security bulletin 2026-152-AWS (CVE-2026-115413)
• GitHub advisory GHSA-fc39-fwh3-wv5r (mcp-gateway-registry)
• GitHub advisory GHSA-4wq9-grf3-qg2p (AWS API MCP Server)
• Microsoft: CVE-2026-109492
• IBM security bulletin: CVE-2026-110278
• IBM security bulletin: CVE-2026-110279
• pgEdge advisory GHSA-j7mp-839j-jrm7
• pgEdge advisory GHSA-r5pp-jx86-r6r9
• MCP TypeScript SDK advisory GHSA-jm63-cq47-j5jp
• NVD: CVE-2026-117558
• CISA Known Exploited Vulnerabilities catalog
• Claude Code docs: MCP
• Cursor docs: MCP
• VS Code docs: MCP configuration reference

Check your own machine

Connect an AI agent to the free, read-only FixLane MCP server or ask the Telegram bot: it checks what you have installed against verified fixed versions and serves a reviewed fix procedure. All guides.