Verfy Advisories

Vulnerabilities in agent tooling

Public, sourced advisories for MCP servers and agent tools, in the OSV format with VERFY-YYYY-NNNN IDs and CVE aliases. Feed: /api/v1/advisories.

Our research, October 2026

MCP tool definitions change between releases, often in patch releases

We installed the newest releases of 46 popular MCP servers on throwaway machines and compared the tools each release served. Of the 34 that started, 28 added, removed or changed a tool definition, and 23 of 70 patch releases changed one: a version range like ^1.2.3 does not freeze what your agent reads. We found no malicious change. The same run showed 163 false alarms in Verfy's own scanner, which 0.5.2 fixes.

Every server, release by release · Method, numbers and limits · Code to re-run it

criticalVERFY-2025-0001CVE-2025-6514source: public record

mcp-remote: OS command injection from a malicious MCP server's OAuth authorization_endpoint

npm · mcp-remote · added 2026-10-11

criticalVERFY-2025-0002CVE-2025-49596source: public record

MCP Inspector: unauthenticated proxy endpoints allow remote code execution

npm · @modelcontextprotocol/inspector · added 2026-10-11

highVERFY-2025-0003CVE-2025-53109source: public record

MCP filesystem server: symlinks inside an allowed directory escape the allowed-directory boundary

npm · @modelcontextprotocol/server-filesystem · added 2026-10-11

highVERFY-2025-0004CVE-2025-53110source: public record

MCP filesystem server: path prefix collision bypasses the allowed-directory check

npm · @modelcontextprotocol/server-filesystem · added 2026-10-11

Entries marked "source: public record" come from public CVE records and were not independently reproduced by Verfy. The advisories are open data in the public repository: anyone can add one by pull request to verfy/advisories, with at least one public source.