MCP 伺服器如今已成攻擊面，近期漏洞重現已知安全問題

Your MCP Server Is the Attack Surface Now

October 2026 has been the worst month yet for Model Context Protocol security. Not because attackers discovered something new, but because they keep rediscovering the same flaws in server after server.

Here is what happened in the last two weeks alone.

The CVEs

Langflow RCE (CVE-2026-105697, CVSS 9.9). Disclosed October 5. Langflow executed the command field from MCP server configs with no allowlist, wrapped in bash -c. Any authenticated user could run arbitrary OS commands on the host. A public proof of concept is available. Fixed in 1.9.0 and 1.10.3.

Official fetch server SSRF (CVE-2026-104120, CVSS 7.3). Published October 2. The fetch_url tool in the official modelcontextprotocol/mcp-server-fetch package allowed server-side request forgery through the url argument. Remotely triggerable. This is the reference implementation shipping the vulnerability.

Unauthenticated debugger (CVE-2026-107824, CVSS 9.3). Published October 9. The x64dbg MCP server exposed every debugger tool over HTTP with no authentication, listening on all interfaces by default. Any network client could attach to processes, read and write memory, and write arbitrary files.

Python SDK credential theft (September 29, CVSS 7.5). The official MCP Python SDK sent client secrets, authorization codes, and PKCE proof keys to attacker-controlled token endpoints. Reported by Cycode. Client secrets are long-lived, so the blast radius extends well past the patch in 1.30.0 and 2.2.0.

The pattern nobody is fixing

Independent researcher Syed Anas Mohiuddin spent five months finding the same SSRF flaw across Google, JPMorgan Chase, Weaviate, Rapid7, a French government directorate, and an Indonesian city government. Five US federal AI servers, including one logging veterans' SSNs in unredacted error responses, were still unpatched six weeks after disclosure.

His conclusion is blunt: the MCP specification has no normative security requirements, and its implicit-trust model means independent teams keep rediscovering the same vulnerability class.

The numbers back him up. The MCPTox benchmark tested 20 LLM agents against 45 real MCP servers and measured attack success rates up to 72.8 percent. More capable models were more vulnerable, not less. Koi Security found the first real-world malicious MCP server in September 2025: fifteen clean releases of the postmark-mcp package, then a quiet update that BCC'd every agent-sent email to an attacker.

MCP has crossed 97 million installs. The registry is approaching 2,000 entries. The attack surface is growing faster than anyone's ability to audit it by hand.

What actually helps

Static rules do not keep up. Every one of the CVEs above was a novel instance of a known class in a new codebase. What catches them is screening tool calls and responses against live threat intelligence: known-bad indicators, phishing-kit fingerprints, scam-associated infrastructure, and neighbor servers with dirty reputations.

That is what the RelayShield MCP Proxy Firewall does. It sits between your agents and their MCP servers, screens every tool call and every response, and blocks or flags what matches the corpus. The pre-deployment scanner is free and catches misconfigurations before you ship. The runtime proxy is $49 a month.

Your MCP server is the attack surface now. Screen it like one.