Originally published on AI Tech Connect.
The 43% problem: what the 2026 CVE class looks like As of September 2026, the most common way an MCP server gets a CVE is not a clever protocol flaw. It is a tool function that takes a string from the model, glues it into a command line, and hands the result to a shell. This is the oldest bug in web security, and it has come back because MCP put a fresh generation of builders in front of subprocess with a caller that is far less trustworthy than a browser form. The figures are consistent across independent sources. Equixly's offensive assessment of popular MCP server implementations found that 43% of the servers it tested contained command injection flaws, 22% allowed reading files outside their intended directory, and 30% permitted unrestricted URL fetching. Practical DevSecOps tallied…
Top comments (0)