Mittwald MCP Server Compromise: Vulnerability Exploited to Access 56 Customer Projects, AI Usage Inferred from Speed

1. Basic Information

• Article Name: Sicherheitsvorfall am MCP-Server
• Publisher: Mittwald
• Publication Date: 2026-11-07
• Collection Date: 2026-11-10T07:46:16+09:00
• Source: Mittwald
• Related Sources: Mittwald MCP FAQ, The Record: cyberattack against German web host Mittwald
• Related Products and Technologies: Mittwald MCP server, mStudio, SSH
• Severity: High
• Severity Basis: A vulnerability in the MCP server was actively exploited, leading to unauthorized access to 56 customer projects. Because MCP allows management operations to be executed via agents, monitoring customer boundaries is required.

2. Executive Summary

Attackers exploited a vulnerability in Mittwald's MCP server, read user session tokens, and accessed 56 customer projects. Passwords were not read, and all session tokens were revoked. Mittwald cited the speed of operations as an indicator of potential AI tool usage, but has not published direct evidence of AI use.

3. Attack Flow

1. The attacker creates an account.
2. The attacker targets and exploits a vulnerability in the MCP server.
3. Using the stolen user session tokens, the attacker gains access to projects permitted by the respective users' privileges and accesses 56 customer projects.
4. Mittwald detects the anomaly and shuts down the MCP server and related services.

4. Attacker Position and Execution Location

• A remote attacker with network reachability to the MCP server who can create an account.
• AI usage is a vendor assessment based on behavioral evaluation, not a confirmed fact.

5. Visibility for Victims and Administrators

Victim Side

• Appears to some users as disabled mStudio and SSH access, blocked projects, and individual notifications.

Administrator Side

• On the provider side, potential indicators to look for include tool calls and project access spanning many projects within a short period from a newly created account. Specific logging details have not been published.
• For customer administrators, indicators include unexpected access to their own projects or individual notifications from the provider.

6. Success and Failure Conditions

Success Conditions

• The vulnerability in the MCP server remains unpatched.
• User session tokens were successfully read through exploitation, and the attacker was able to reach the user's projects using those token privileges (internal details of the vulnerability that enabled token retrieval have not been published).

Failure Conditions and Mitigations

• Shut down and patch the MCP server, and enforce project-level authorization. Short-lived tokens limit how long leaked tokens can be abused, but do not prevent exploitation of the underlying vulnerability.

7. What Happens Upon Success

• Unauthorized access to 56 customer projects.
• As part of the provider's containment response, management services were shut down and customer projects were blocked.

8. Observable Logs

The following are general investigation candidates. The observable scope differs between the provider side and the customer side, and specific log specifications are not public. Each item is checked if it is collected by the target system.

• Email: No email vectors specific to this incident have been published.
• Proxy/SWG/DNS: Check for connections to the Mittwald MCP server from unknown sources.
• Endpoint/EDR: Check for suspicious processes, files, and child processes on the Mittwald MCP server.
• Identity/IdP: Check account logins, token issuance, and privilege changes.
• SaaS/Cloud: Check management APIs, object access, and configuration changes.
• Network: Check for anomalous requests and subsequent communications.

9. Attack Success Determination

Information Theft or Session Compromise Confirmed

• Public Information: Mittwald confirmed that session tokens belonging to MCP server users were read. Those tokens allowed access to mStudio and to projects accessible to the respective users, with those users' permissions. All session tokens have been revoked. The extent to which files, databases, email, and other data were retrieved from individual projects remains under investigation.
• Confirmation Scope: The scope of projects identified in Mittwald's forensic review.

10. Investigation Playbook

• Trigger: MCP server anomalies and mass project access by a new account serve as triggers.
• Initial Check: Check version, exposure, source, account, and initial anomaly time. Investigate tool calls and customer data from October 27 onward under the assumption of a compromise.
• Endpoint: Preserve process trees, files, memory, and persistence mechanisms.
• Authentication and Cloud: Check the creation and use of accounts, tokens, and secrets.
• Subsequent Operations: Examine subsequent commands, data access, and lateral movement.
• Containment: Isolate services, apply patches, revoke credentials, and perform a clean rebuild if necessary.
• Determination Categories: Separate account creation, exploitation, project access, and data retrieval or modification.

11. Defense and Detection Ideas

• Single Event: Detect sequential tool calls across multiple projects by a new MCP account.
• Timeline Correlation: Correlate events in chronological order from initial access to privilege acquisition, subsequent commands, and data access.
• Hunting: Search across available logs using MCP tool names, project IDs, token subjects, and source IP addresses.
• Log Shortages: Combine asset, account, and network telemetry when public IOCs or detailed logs are unavailable.
• Priority Controls: Prioritize project-level least privilege, short-lived tokens, MCP call auditing, and rate limiting.

12. Facts, Inference, and Hypothesis

Facts

• Initial testing on October 21, activity as a regular user from October 23 (registering test accounts, using Extensions, and attempting simple injections), and targeted exploitation on October 27 at 15:03 were confirmed.
• After creating an account on October 27, the attacker exploited a vulnerability in the MCP server.
• Fifty-six customer projects were affected, and Mittwald treats the relevant data from October 27 onward as compromised.
• Session tokens of MCP server users were read. Passwords were not read, and all session tokens were revoked.
• Anomalies were detected on November 4, and the MCP server along with some related services were stopped.
• AI usage is a vendor assessment based on attack speed and intervals; direct evidence such as models or prompts has not been published.

Inference

• The privileges associated with the stolen tokens determined which projects the attacker could access. Internal details of the vulnerability that enabled token retrieval have not been published.

Hypothesis

• No additional hypotheses.

13. MITRE ATT&CK Mapping

ID	Technique	Confidence	Basis
T1190	Exploit Public-Facing Application	High	A vulnerability in the MCP server was actively exploited by an external attacker.

14. Unknowns and Additional Investigations

• Vulnerability details, retrieved or modified data, direct evidence of AI usage, and the attacker remain unpublished.

15. Impact on SOCs and Organizations

When connecting MCP to a management plane, prioritize reviewing the customer and project boundaries accessible through MCP and auditing tool calls over determining whether AI was used.

16. Summary by Target Audience

• For SOCs: Track cross-project tool calls and project access.
• For Administrators: Establish project-level permissions, short-lived tokens, and MCP shutdown procedures.
• For Users: Follow individual notifications, credential resets, and change history checks.