Hundreds of MCP servers found misconfigured and exposed to RCE and data breaches
Research by Backslash Security found that hundreds of Model Context Protocol servers deployed globally are misconfigured and exposed to remote code execution and data breach attacks, with insufficient authentication and input validation allowing potential full system compromise.
What happened
Analysis by Backslash Security of over 7,000 publicly accessible MCP servers found that hundreds were misconfigured and vulnerable to serious security threats including remote code execution (RCE) and data breaches.
Approximately 70 servers contained critical vulnerabilities such as unchecked input handling and excessive permissions. Hundreds more were exposed to unauthenticated connections from devices on the same local network through a vulnerability called 'NeighborJack.' In several cases, both issues coincided, allowing attackers to completely take over the host machine.
MCP servers can also be manipulated in context poisoning attacks where data supplied to large language models is tampered with, skewing their outputs. Researchers found one company operating an MCP serving tens of thousands of users without defenses against such tampering.
Reported impact
Over 15,000 MCP servers are deployed globally despite the protocol emerging only in late 2024. Of these, approximately 7,000 are exposed to the public internet, with hundreds misconfigured or lacking authentication safeguards that were intended to restrict access.
Attackers could exploit the identified vulnerabilities to delete data, run arbitrary code, or take complete control of systems. The combination of weak authentication with insecure input handling creates entry points for attackers to compromise AI applications and access sensitive organizational data.
Index analysis
MCP servers' rapid adoption has outpaced secure deployment practices. The technology is new enough that security standards and practices remain underdeveloped, with many servers left unprotected due to poor setup or lack of authentication.
The research identified that MCPs function as proxies that can inadvertently obfuscate the client-side actor, introducing security risks alongside their intended function of extending AI capabilities beyond training data.
Governance controls
Backslash Security introduced the MCP Server Security Hub, a searchable database evaluating the security posture of over 7,000 MCP servers, and a free self-assessment tool to audit development environments.
Recommended precautions include limiting access to local network interfaces, validating external inputs, restricting file system access, avoiding exposure of internal logs or secrets in AI responses, and implementing strict authentication and access controls.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.