I pulled every CVE mentioning MCP published between 2026-08-25 and 2026-09-01 straight from the NVD API. 42 results. Then I read the descriptions and classified them.
Nine are CVSS 9.0 or above. Two are 10.0.
Three mention prompt injection.
Here is what the rest are:
auth optional or absent 8
Host / Origin / DNS-rebind 5
path traversal 5
bind to all interfaces 4
supply chain / unpinned ref 1
other 22
Some of the specific ones, quoted from NVD:
CVE-2026-81098, CVSS 9.3: "The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller credential."
CVE-2026-81094, CVSS 9.3: "The mcp-router CLI served its MCP aggregator on every interface and enforced authentication only when the operator asked for it."
CVE-2026-81092, CVSS 7.6: mcp-go "accepted requests on its HTTP transports without checking the Host header."
CVE-2026-82021, CVSS 9.0: Hermes Agent's bundled MCP catalog referenced an upstream repo "via a mutable branch rather than a pinned commit SHA."
CVE-2026-81735 and CVE-2026-82456, both 10.0: UI-TARS-desktop and argocd-mcp, both defaulting the listen address to every interface.
None of that is a model problem. It is 1990s network-service hygiene, shipped in 2026 by people who were thinking about the model.
The pattern I would take away, if you self-host anything MCP: your threat model probably starts one layer lower than you think it does. Bind address, Host header check, and whether auth is on by default or opt-in. Those three questions would have caught most of this week.
Query if you want to reproduce it; no key needed:
[services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=MCP&pubStartDate=2026-08-25T00:00:00.000&pubEndDate=2026-09-01T00:00:00.000](http://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=MCP&pubStartDate=2026-08-25T00:00:00.000&pubEndDate=2026-09-01T00:00:00.000)
Curious whether people running local MCP servers are binding to loopback by default, or whether the defaults caught you too.
Source: r/SecOpsDaily · by /u/Available_Teaching83