{
  "entry": {
    "kind": "vuln",
    "slug": "pluto-operation-mcp-147-of-179-internet-facing-mcp-servers-accepted",
    "name": "pluto-operation-mcp-147-of-179-internet-facing-mcp-servers-accepted",
    "vendor": "Not a single-product CVE — operational exposure of remotely reachable MCP servers that skip authentication on tools/c",
    "description": "Pluto Security (Avishai Gonen, Ehud Melzer) published on 24 September 2026 the results of Operation:MCP internet scanning: 179 confirmed exposed MCP server deployments, of which 147 (82%) accepted unauthenticated requests with no login, token, or session check. Manual severity across the corpus: 26 critical, 19 high, 24 medium, 110 low; 140 were still live at publication. Impact classes among servers with full tool visibility included write/state-changing tools (57), read-only (43), financial/commerce (23), and full code execution (7). Concrete cases (redacted in the write-up, disclosed to operators/NCSC) included root `exec` on production boxes with plaintext Stripe/GitHub/AWS keys in the environment, a nine-figure digital media company's unauthenticated 30-tool server exposing private report buckets, production SQL, CMS/paywall writes and subscriber export, and a Swiss municipal citizen-administration MCP (`ags-daemon`) that accepted unauthenticated `ags_anliegen` calls keyed on AHV (national social-insurance) numbers for passport/ID/residence workflows — disclosed to Switzerland's NCSC and closed. Pluto stresses there is no novel exploit: MCP `tools/list` is commonly unauthenticated by design, so finding privileged servers is a search problem (e.g. Shodan facets), and binding shell or data-plane tools to 0.0.0.0 without authenticating `tools/call` is the recurring mistake. Geography of the 179: US 89, Germany 22, China 11, Canada 10, Japan 8.",
    "website": "https://pluto.security/blog/wide-open-hundreds-of-mcps-exposing-root-shells-production-data-and-citizen-records-one-call-away/",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "mcp-server",
    "updatedAt": "2026-09-24",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "pluto-operation-mcp-147-of-179-internet-facing-mcp-servers-accepted",
      "aliases": [
        "ti-107"
      ],
      "title": "Pluto Operation:MCP: 147 of 179 Internet-Facing MCP Servers Accepted Unauthenticated tools/call (Root Shells to Citizen Registries)",
      "summary": "Pluto Security (Avishai Gonen, Ehud Melzer) published on 24 September 2026 the results of Operation:MCP internet scanning: 179 confirmed exposed MCP server deployments, of which 147 (82%) accepted unauthenticated requests with no login, token, or session check. Manual severity across the corpus: 26 critical, 19 high, 24 medium, 110 low; 140 were still live at publication. Impact classes among servers with full tool visibility included write/state-changing tools (57), read-only (43), financial/commerce (23), and full code execution (7). Concrete cases (redacted in the write-up, disclosed to operators/NCSC) included root `exec` on production boxes with plaintext Stripe/GitHub/AWS keys in the environment, a nine-figure digital media company's unauthenticated 30-tool server exposing private report buckets, production SQL, CMS/paywall writes and subscriber export, and a Swiss municipal citizen-administration MCP (`ags-daemon`) that accepted unauthenticated `ags_anliegen` calls keyed on AHV (national social-insurance) numbers for passport/ID/residence workflows — disclosed to Switzerland's NCSC and closed. Pluto stresses there is no novel exploit: MCP `tools/list` is commonly unauthenticated by design, so finding privileged servers is a search problem (e.g. Shodan facets), and binding shell or data-plane tools to 0.0.0.0 without authenticating `tools/call` is the recurring mistake. Geography of the 179: US 89, Germany 22, China 11, Canada 10, Japan 8.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Authentication bypass"
      ],
      "componentType": "mcp-server",
      "component": {
        "name": "Not a single-product CVE — operational exposure of remotely reachable MCP servers that skip authentication on tools/c",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "Not a single-product CVE — operational exposure of remotely reachable MCP servers that skip authentication on tools/call (and often bind beyond localhost). Any coding agent or IDE configured to talk to such a server inherits the server's privileges.",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-09-24",
      "modifiedAt": "2026-09-24",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://pluto.security/blog/wide-open-hundreds-of-mcps-exposing-root-shells-production-data-and-citizen-records-one-call-away/"
        }
      ],
      "mitigation": "Inventory every MCP endpoint reachable from outside the laptop loopback: authenticate tools/call (discovery/tools/list can stay open; execution and data retrieval must not), authorize per tool rather than per server, and bind listeners to localhost or a private network unless there is a deliberate reverse-proxy with auth in front. Scan your own external attack surface for MCP fingerprints before attackers do. Treat any MCP server that wraps exec, SQL, CMS writes, or citizen/PII workflows as a Tier-0 interface — same identity, authorization, and logging you would demand of an admin API. If you unexpectedly ran an MCP server on 0.0.0.0 during a demo, shut it down and rotate every secret that process could read. Prefer allowlisted local stdio MCP servers over ad-hoc remote HTTP/SSE endpoints for developer agents.",
      "detectedByAnomity": true
    }
  }
}