Anthropic MCP Design Vulnerability Enables RCE: 200k+ Servers at Risk
Anthropic MCP Design Vulnerability Enables RCE: 200k+ Servers at Risk is a critical-severity remote code execution issue in MCP SDK, a MCP server. Affected: MCP SDK (all languages), STDIO transport pre-patch.
Is MCP SDK running on your developers' machines? Anomity finds every device with this MCP server installed, shows the version, and can block it by policy. Detect this across your developers' devices with Anomity →
Key facts
- ID
anthropic-mcp-design-vulnerability-enables-rce-200k-servers-at-risk- Severity
- critical
- Attack type
- Remote code execution, Supply chain compromise
- Component
- MCP SDK · MCP server
- Known exploited
- No known exploitation
- Published
- Last verified
What is this vulnerability?
OX Security disclosed a systemic vulnerability baked into Anthropic's official MCP SDK across Python, TypeScript, Java, and Rust. Unsafe defaults in STDIO transport allow arbitrary command execution on any system running a vulnerable MCP implementation, granting attackers access to user data, databases, API keys, and chat histories. Over 7,000 publicly accessible servers and packages totaling 150M+ downloads are affected. 14 CVEs assigned across LiteLLM, LangFlow, Flowise, DocsGPT, and GPT Researcher. Anthropic declined to modify the protocol, citing the behavior as "expected."
Affected versions
| Affected | Fixed in |
|---|---|
MCP SDK (all languages), STDIO transport pre-patch | No fixed version listed |
Am I affected by this vulnerability?
You are affected if you run MCP SDK (all languages), STDIO transport pre-patch.
How do I fix it?
Audit MCP server configurations for STDIO transport exposure. Update affected MCP packages (LiteLLM, LangFlow, Flowise). Implement input validation on all MCP tool inputs. Restrict MCP server network access to trusted endpoints only.
How do I find every machine running MCP SDK?
Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run MCP SDK and which version, then enforce a policy on it.