The MCP attack surface is the transport, not the protocol

Ten days of advisories, and the striking thing is what is absent. Almost none of them describe a flaw in Model Context Protocol. They describe the code that carries it: the transports, the wrappers, the servers somebody built in an afternoon to put a tool behind an agent.

The allowlist and the shell disagreed, again

The worst of them is a straight unauthenticated remote code execution, and the mechanism is worth reading slowly. The validation function checked the name of the executable against an allowlist. It did not look at the arguments. The arguments went on to the thing that spawns the subprocess, unchanged.

So the allowlist says yes to a permitted binary, and the permitted binary is one that runs whatever string you hand it. Nothing was bypassed. The check did exactly what it was written to do, on a different object than the one that mattered.

We wrote the same sentence about three coding agents a few days ago: validation that inspects a command as a plain string diverges from the shell that executes it. This is that failure with an MCP label on it.

The transports are the surface

Two more from the same project make the pattern explicit. The endpoint for the SSE and streamable-HTTP transports took a URL and a headers dictionary straight from the caller and made the request. An attacker sets Authorization or Cookie and reaches internal services with credentials attached. The responses never come back, which makes it blind, and blind is enough when the request itself changes state.

Elsewhere, a Go server binds its Streamable HTTP listener to localhost, skips authentication when the token variable is unset, and validates neither Host nor Origin. Binding to localhost feels like a boundary. It is not one, because a browser on that machine will happily send the request for an attacker, and without an Origin check the server cannot tell the difference.

None of this is a protocol defect. The specification does not tell anyone to trust a caller-supplied URL, and it does not say the loopback interface is an authentication mechanism. The flaws are in the plumbing that speaks it, which is the part everyone writes themselves.

Including the official SDK

The most quietly instructive one is in an official SDK rather than somebody's side project. Its HTTP client reads an event stream and appends each chunk to a buffer that is only emptied when a delimiter arrives. A server that never sends the delimiter is not doing anything illegal; it is just never finishing a sentence. The client keeps listening, and the buffer keeps growing.

That is not a clever exploit. It is a parser written for a cooperative peer, shipped into a world where the peer is chosen by whoever configured the agent.

Prompt injection now has a CVE, and two different scores

The last one matters beyond its own product. Poisoned instructions, delivered through a legitimate feature and served over MCP, used to make an agent hand over environment credentials. It has an identifier, an advisory and a fix, which is progress.

It also has two base scores, from the same assessor, for the same flaw:

CVSS 3.1  ->  9.0  CRITICAL
CVSS 4.0  ->  6.4  MEDIUM

The gap is not sloppiness. It is the newer standard doing something the older one cannot: separating what happens to the vulnerable system from what happens to everything downstream of it. For prompt injection the vulnerable system is barely scratched. The damage lands entirely on the systems the agent can reach next.

Under the older standard that downstream damage has nowhere to go except the base score, so it reads Critical. Under the newer one it moves into its own columns and the headline number falls by more than two and a half points. Neither number is wrong, and that is the problem: a team triaging by score alone will treat the same finding as a drop-everything or as a backlog item depending on which standard their tooling reports.

What to do with this

• Patch the named versions in the ledger below, and check whether MCP is enabled at all before assuming you are affected.
• Treat every MCP server as an untrusted peer. Bound your buffers, time out your streams, and never let a caller choose the URL you fetch or the headers you attach.
• Localhost is not authentication. Validate Host and Origin on any local listener an agent talks to, or a browser elsewhere on the machine will speak for the attacker.
• Do not triage agent findings by base score alone. Ask what the agent can reach, because that is where the impact actually lands and it is exactly what the older score cannot express.