{
  "entry": {
    "kind": "vuln",
    "slug": "anthropic-mcp-design-vulnerability-enables-rce-200k-servers-at-risk",
    "name": "anthropic-mcp-design-vulnerability-enables-rce-200k-servers-at-risk",
    "vendor": "MCP SDK",
    "description": "OX Security disclosed a systemic vulnerability baked into Anthropic's official MCP SDK across Python, TypeScript, Java, and Rust. Unsafe defaults in STDIO transport allow arbitrary command execution on any system running a vulnerable MCP implementation, granting attackers access to user data, databases, API keys, and chat histories. Over 7,000 publicly accessible servers and packages totaling 150M+ downloads are affected. 14 CVEs assigned across LiteLLM, LangFlow, Flowise, DocsGPT, and GPT Researcher. Anthropic declined to modify the protocol, citing the behavior as \"expected.\"",
    "website": "https://www.ox.security/blog/the-mother-of-all-ai-supply-chains-critical-systemic-vulnerability-at-the-core-of-the-mcp/",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "mcp-server",
    "updatedAt": "2026-04-15",
    "risk": {
      "score": 90,
      "band": "critical",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "anthropic-mcp-design-vulnerability-enables-rce-200k-servers-at-risk",
      "aliases": [
        "ti-011"
      ],
      "title": "Anthropic MCP Design Vulnerability Enables RCE: 200k+ Servers at Risk",
      "summary": "OX Security disclosed a systemic vulnerability baked into Anthropic's official MCP SDK across Python, TypeScript, Java, and Rust. Unsafe defaults in STDIO transport allow arbitrary command execution on any system running a vulnerable MCP implementation, granting attackers access to user data, databases, API keys, and chat histories. Over 7,000 publicly accessible servers and packages totaling 150M+ downloads are affected. 14 CVEs assigned across LiteLLM, LangFlow, Flowise, DocsGPT, and GPT Researcher. Anthropic declined to modify the protocol, citing the behavior as \"expected.\"",
      "severity": "critical",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Remote code execution",
        "Supply chain compromise"
      ],
      "componentType": "mcp-server",
      "component": {
        "name": "MCP SDK",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "MCP SDK (all languages), STDIO transport pre-patch",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-04-15",
      "modifiedAt": "2026-04-15",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://www.ox.security/blog/the-mother-of-all-ai-supply-chains-critical-systemic-vulnerability-at-the-core-of-the-mcp/"
        }
      ],
      "mitigation": "Audit MCP server configurations for STDIO transport exposure. Update affected MCP packages (LiteLLM, LangFlow, Flowise). Implement input validation on all MCP tool inputs. Restrict MCP server network access to trusted endpoints only.",
      "detectedByAnomity": true
    }
  }
}