Notifications
Clear all
Topic starter
02/08/2026 11:37 am
TL;DR: OX Security found three vulnerabilities across widely used MCP tools and Archon OS, including CVE-2025-65719 and CVE-2025-69443, exposing organisations to arbitrary code execution, unauthenticated API key theft, and local file read risk across projects with more than 140k GitHub stars and 60k DockerHub downloads. The core issue is that trusted integration layers are becoming identity and data access surfaces without matching controls.
NHIMG editorial — based on content published by OXSecurity: MCP vulnerabilities exposing AI toolchains to remote code execution and credential theft
By the numbers:
- Collectively representing over 140k GitHub stars and 60k DockerHub downloads, these vulnerabilities expose organizations to data exfiltration, credential theft, and lateral movement.
Questions worth separating out
Q: What breaks when MCP tools are treated as harmless local utilities?
A: Local-only MCP tools can still expose code execution, file reads, and secret theft if they sit inside a weak trust boundary.
Q: Why do MCP-connected AI workflows increase lateral movement risk?
A: Because a single compromised integration point can provide reusable access to files, APIs, and session material that other systems trust.
Q: How do security teams know whether an MCP tool is over-privileged?
A: Look for any tool that can access more directories, APIs, secrets, or commands than its immediate task requires.
Practitioner guidance
- Inventory every MCP-connected tool and service Map which tools can read files, reach APIs, access secrets, or execute commands.
- Restrict MCP runtime scope to isolated environments Run MCP tools inside closed containers or tightly segmented hosts with no broad filesystem access and no unnecessary network exposure.
- Apply secret governance to tool-connected workflows Eliminate hard-coded keys, scope every credential to the smallest possible task, and separate secret access from general application access.
What's in the full report
OXSecurity's full research covers the operational detail this post intentionally leaves for the source:
- Step-by-step vulnerability breakdowns for kubectl-mcp-server, Archon OS, and MarkItDown MCP
- Responsible disclosure timeline and maintainer responses for each affected project
- Technical proof paths showing how the CORS bypass, API theft, and file read issues were reached
- Practical exploitation notes that help engineers validate exposure in their own environments
👉 Read OXSecurity's analysis of MCP vulnerabilities exposing AI toolchains to RCE and theft →
MCP security gaps in AI toolchains: what practitioners need to know?
Explore further
02/08/2026 12:50 pm
MCP integration risk is an identity problem before it is an application problem. These tools sit between users, AI systems, repositories, and cloud services, so they inherit privilege without necessarily inheriting the controls that normally govern privilege. That makes the integration layer a governance boundary, not a convenience layer. Practitioners should classify MCP-connected components as part of the identity estate, not as neutral plumbing.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials, according to AI Agents: The New Attack Surface report.
- A separate finding shows that only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: Who should own governance for MCP tools inside AI environments?
A: Ownership should sit with the team responsible for identity governance and privileged access, not only application engineering. If an MCP tool can read secrets, access data, or trigger actions, the organisation should assign an accountable owner, define scope, and review it through the same governance path as other high-risk non-human identities.
👉 Read our full editorial: MCP integration risks expose AI toolchains to code execution and theft
