Build my server

Guides

MCP Security Roundup (Oct 2026)

By Team TrustedMCP

On this page
MCP Security Roundup (Oct 2026)

Three things need action this month. Update VS Code and n8n, which both fixed MCP-related flaws. Upgrade the official MCP SDKs if you build servers or clients. And check your deadlines: Salesforce's local MCP server ends on 2 November, and Stripe stops accepting old key types after 30 November.

Every item below has a date and a primary source. If you are new to judging servers, start with our 5-minute security risk check. This is one issue of our monthly MCP news roundup. To get security alerts by email, join the MCP newsletter.

Act now

  • Now: update VS Code to 1.141.1 or later.
  • Now: update n8n to 1.123.89, 2.45.5, 2.46.1 or 3.0.1 (or later).
  • Now: upgrade @modelcontextprotocol/sdk to 1.32.0+ (or @modelcontextprotocol/client 2.3.0+), and Python mcp to 1.30.0+ or 2.2.0+.
  • Now: if you run Langflow, update to 1.10.3. If you run the AWS API MCP Server, update to 1.6.0.
  • Now: update mcp-server-fetch to 2026.10.24+ and chrome-devtools-mcp to 1.5.0+.
  • By 2 November 2026: move off the local @salesforce/mcp package.
  • By 30 November 2026: replace full-access and non-Agent restricted keys used with Stripe MCP.

Vulnerabilities in servers we list

VS Code: MCP sandbox approvals shared between servers

  • What happened: On 13 October 2026, Microsoft published CVE-2026-102851 (medium). Network and file-write permissions you approved for one MCP server were saved in shared sandbox settings, so other servers in the same configuration could use them too.
  • Who's affected: VS Code 1.141.0 and earlier.
  • What to do: Update to 1.141.1 or later. Then review which MCP servers share a configuration.
  • Source: GHSA-qghm-w43w-vx8v · Listing: VS Code MCP

n8n: three MCP-related advisories

  • What happened: On 28 October 2026, n8n disclosed an open redirect in its MCP OAuth endpoints (medium). Anyone could register a client with any redirect URL and use the instance to bounce visitors elsewhere. No tokens leaked. On 14 October 2026, two earlier n8n advisories received CVEs: CVE-2026-110842 (high), where the MCP workflow-validation tool could be abused to take over the owner account, and CVE-2026-110852 (medium), where webhook, form and MCP routes could run workflows without the URL's secret identifier.
  • Who's affected: Self-hosted n8n before 1.123.89, 2.45.5, 2.46.1 or 3.0.1 for the redirect. The account-takeover issue is fixed only in 2.41.4 and 2.42.1. MFA-protected owner accounts were not affected by it.
  • What to do: Upgrade to a current release. If you can't yet, block unauthenticated access to /mcp-oauth/register and /mcp-oauth/authorize, or turn off the instance-level MCP server.
  • Sources: GHSA-rc3w-8jc8-7x3w, GHSA-5jr4-xmvf-frmj, GHSA-4c7j-qff5-r9cx · Listing: n8n MCP Server

Fetch reference server: SSRF fixed, then two bypasses fixed

  • What happened: CVE-2026-104120 (medium), published 2 October 2026: the fetch_url tool could be pointed at internal addresses. The fix shipped in mcp-server-fetch 2026.10.10 (11 October), which now refuses private, loopback and cloud-metadata addresses by default. On 25 October two bypasses of that guard (IDNA hostnames, NAT64) and a robots.txt bypass through redirects were published, all fixed in 2026.10.24.
  • Who's affected: mcp-server-fetch before 2026.10.24. The NVD record still says no fix was accepted; it is out of date.
  • What to do: Update to 2026.10.24 or later and never pass --allow-private-ips. The README says the guard still doesn't stop DNS rebinding, so keep it off networks with sensitive internal services.
  • Sources: NVD CVE-2026-104120, fix PR #5033, servers advisories · Listing: Fetch MCP Server

Chrome DevTools MCP: file access outside allowed roots

  • What happened: On 22 October 2026, the Chrome DevTools team published CVE-2026-106484 (GHSA-5hw5-4q87-m6x9, medium). A symlink could send a tool's output file outside the MCP roots it was limited to. A second advisory the same day (GHSA-xfxg-8r4q-wj4v) covered service-worker requests slipping past the URL allow and block lists.
  • Who's affected: chrome-devtools-mcp 1.1.0 through 1.4.0. The fix shipped in 1.5.0 on 3 July 2026, months before the advisory.
  • What to do: Run a current release (1.12.0 is current). Use --isolated so the browser profile doesn't keep your logins.
  • Source: GHSA-5hw5-4q87-m6x9 · Listing: Chrome DevTools MCP

Other MCP vulnerabilities

Langflow: command execution through MCP stdio settings

  • What happened: CVE-2026-105697 (critical), published 5 October 2026. Any user who could add an MCP server in Langflow could run any OS command on the host. With the default auto-login setting, an exposed instance needed no account.
  • Who's affected: Langflow before 1.10.3.
  • What to do: Update to Langflow 1.10.3 and turn off LANGFLOW_AUTO_LOGIN on anything reachable from a network.
  • Source: GHSA-w794-rj3p-xv45

Google MCP Toolbox for Databases: file theft and overwrite

  • What happened: CVE-2026-93328 (critical), published 26 October 2026. The cloud-storage source let an unauthenticated caller copy host files to outside storage buckets and overwrite local files.
  • Who's affected: googleapis/mcp-toolbox 1.2.0 through 1.4.0.
  • What to do: Run a version later than 1.4.0. The current release is 1.15.0.
  • Source: GHSA-2gc9-c85v-5vwr

AWS API MCP Server: tokens for other apps accepted

  • What happened: CVE-2026-115413 (high), published 27 October 2026. In OAuth mode the server did not check a token's audience, so a token issued to another app by the same identity provider could run AWS operations.
  • Who's affected: awslabs.aws-api-mcp-server before 1.6.0.
  • What to do: Update to 1.6.0 and set the expected token audience or client ID. Better: AWS says this self-run server is superseded by its hosted AWS MCP Server, so plan to move.
  • Source: AWS security bulletin 2026-152 · Hosted replacement: AWS MCP Server

mcp-remote: tokens sent over plain HTTP

  • What happened: CVE-2026-108716 (medium), published 11 October 2026. The device-code sign-in flow would send the client secret and receive tokens over plain http:// endpoints.
  • Who's affected: mcp-remote 0.8.0 through 0.14.3.
  • What to do: Use 0.14.4 or later (0.15.2 is current), and only connect to https:// servers.
  • Source: GHSA-jrvg-vw6c-rp59

FastMCP: authorization skipped on direct calls

  • What happened: On 23 October 2026, FastMCP disclosed that a client knowing a tool's name could call a tool, resource or prompt that the server's policy denied, after a transform (medium). A second advisory the same day covered OAuth client secrets in 4.x being sent to an attacker-chosen authorization server.
  • Who's affected: fastmcp 3.0.0 to before 3.4.10, and 4.0.0 to before 4.1.2.
  • What to do: Update to 3.4.10 or 4.1.2.
  • Sources: GHSA-7xgj-8392-5q4r, GHSA-vqqp-x5qm-5qp4

Vendor changes

Stripe: old key types stop working after 30 November

  • What happened: Stripe's MCP docs say: "Migrate by 30 November 2026. Starting in December, Stripe MCP will stop accepting full-access secret keys and restricted API keys without the Agent tag."
  • Who's affected: Anyone connecting to mcp.stripe.com with a secret key or an untagged restricted key. Those requests will get a 401.
  • What to do: Reconnect with OAuth, or create an agent API key with only the permissions you need. Test it in a sandbox, then expire the old key.
  • Source: Stripe MCP docs · Listing: Stripe MCP

Salesforce: local DX MCP server ends 2 November

  • What happened: On 5 October 2026, Salesforce announced that the local @salesforce/mcp server reaches end of life on 2 November 2026. The repos will be archived and the npm package deprecated. Salesforce now points users to skills instead.
  • Who's affected: Anyone running @salesforce/mcp locally. Pinned installs keep working, but get no more fixes.
  • What to do: Plan your move now. Our listing covers Salesforce's hosted MCP servers, which are not affected.
  • Source: forcedotcom/mcp issue #46 · Listing: Salesforce Hosted MCP

MongoDB MCP Server 3.1.0: safer defaults

  • What happened: Released 15 October 2026. Binding the HTTP server to a non-loopback address now needs an explicit opt-in. Write stages in aggregations ask for confirmation. Unknown tool arguments are rejected, and secrets in config output and logs are redacted by default.
  • Who's affected: Everyone on 3.0.x or earlier.
  • What to do: Update, and check any setup that relied on binding to 0.0.0.0.
  • Source: v3.1.0 release notes · Listing: MongoDB MCP Server

GitHub MCP Server 2.0.3: rebuilt for a compromised CA

  • What happened: Released 21 October 2026. It moves to Go 1.27.3 so binaries reject certificates chained to the compromised eMudhra intermediates. GitHub notes that existing binaries must be rebuilt to get the fix.
  • Who's affected: People running the local binary or Docker image.
  • What to do: Update to 2.0.3 or later. The hosted server is managed by GitHub.
  • Source: PR #3540, v2.0.3 release · Listing: GitHub MCP Server

Recent changes worth knowing

  • Ahrefs local server is archived. Ahrefs marked ahrefs/ahrefs-mcp-server as unmaintained in its README on 19 February 2026, and the repo is now read-only. GitHub does not show the exact archive date. Use the remote server instead. Source: repo README · Listing: Ahrefs MCP

Spec and SDK

There was no new spec release in October. The current version is still 2026-07-28. The October news is in the SDKs.

  • TypeScript SDK. Three advisories: an OAuth flaw that let a malicious server redirect stored credentials (CVE-2026-104850, high, 6 October), cross-origin redirects that resent custom headers and token request bodies (CVE-2026-111769, medium, 20 October), and shared task stores that let clients read each other's tasks (CVE-2026-111767, high, 20 October). Fixed in @modelcontextprotocol/sdk 1.32.0 and @modelcontextprotocol/client 2.3.0. Source: typescript-sdk advisories
  • Python SDK. Five advisories published on 14 and 27 October: unbounded sessions and request bodies (memory exhaustion), bearer tokens for other services accepted, cross-origin redirects carrying headers, and clients fetching server-chosen $ref URLs. All are fixed in mcp 1.30.0 and 2.2.0. Source: python-sdk advisories
  • Java SDK. CVE-2026-108395 (high, 14 October): HTTP transports read request bodies with no size limit. Fixed in mcp-core 0.18.4, 1.1.4 and 2.0.1. Source: NVD
  • Kotlin and Rust SDKs. Kotlin SDK through 0.15.0 has no WebSocket frame size limit (CVE-2026-108714, high, 11 October; no fixed version named). Rust rmcp before 2.0.0 fetched server-controlled OAuth metadata URLs (medium, 2 October; fixed in 2.0.0). Sources: NVD, GHSA-c9xm-49cp-xcr9
  • Docs. On 5 October 2026, the MCP site added a Local Server Security guide. It covers what a local server can reach on your machine. Source: PR #3072

How we track this

We search NVD and the GitHub Advisory Database for MCP-related records each month, and check vendor docs and release notes for the servers we list. Registry Watch checks every server in the official MCP Registry daily. For hardening your own setup, see our MCP security best practices.