# pluto-operation-mcp-147-of-179-internet-facing-mcp-servers-accepted: Pluto Operation:MCP: 147 of 179 Internet-Facing MCP Servers Accepted Unauthenticated tools/call (Root Shells to Citizen Registries)

> Pluto Operation:MCP: 147 of 179 Internet-Facing MCP Servers Accepted Unauthenticated tools/call (Root Shells to Citizen Registries) is a high-severity authentication bypass issue in Not a single-product CVE — operational exposure of remotely reachable MCP servers that skip authentication on tools/c, a MCP server. Affected: Not a single-product CVE — operational exposure of remotely reachable MCP servers that skip authentication on tools/call (and often bind beyond localhost). Any coding agent or IDE configured to talk to such a server inherits the server's privileges..

- **Canonical URL:** https://catalog.anomity.ai/vuln/pluto-operation-mcp-147-of-179-internet-facing-mcp-servers-accepted
- **Aliases:** ti-107
- **Severity:** high
- **Attack type:** Authentication bypass
- **Component:** Not a single-product CVE — operational exposure of remotely reachable MCP servers that skip authentication on tools/c (MCP server)
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-09-24
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/pluto-operation-mcp-147-of-179-internet-facing-mcp-servers-accepted

## Summary

Pluto Security (Avishai Gonen, Ehud Melzer) published on 24 September 2026 the results of Operation:MCP internet scanning: 179 confirmed exposed MCP server deployments, of which 147 (82%) accepted unauthenticated requests with no login, token, or session check. Manual severity across the corpus: 26 critical, 19 high, 24 medium, 110 low; 140 were still live at publication. Impact classes among servers with full tool visibility included write/state-changing tools (57), read-only (43), financial/commerce (23), and full code execution (7). Concrete cases (redacted in the write-up, disclosed to operators/NCSC) included root `exec` on production boxes with plaintext Stripe/GitHub/AWS keys in the environment, a nine-figure digital media company's unauthenticated 30-tool server exposing private report buckets, production SQL, CMS/paywall writes and subscriber export, and a Swiss municipal citizen-administration MCP (`ags-daemon`) that accepted unauthenticated `ags_anliegen` calls keyed on AHV (national social-insurance) numbers for passport/ID/residence workflows — disclosed to Switzerland's NCSC and closed. Pluto stresses there is no novel exploit: MCP `tools/list` is commonly unauthenticated by design, so finding privileged servers is a search problem (e.g. Shodan facets), and binding shell or data-plane tools to 0.0.0.0 without authenticating `tools/call` is the recurring mistake. Geography of the 179: US 89, Germany 22, China 11, Canada 10, Japan 8.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| Not a single-product CVE — operational exposure of remotely reachable MCP servers that skip authentication on tools/call (and often bind beyond localhost). Any coding agent or IDE configured to talk to such a server inherits the server's privileges. | no fixed version listed |

## Am I affected by this vulnerability?

You are affected if you run Not a single-product CVE — operational exposure of remotely reachable MCP servers that skip authentication on tools/call (and often bind beyond localhost). Any coding agent or IDE configured to talk to such a server inherits the server's privileges..

## How do I fix it?

Inventory every MCP endpoint reachable from outside the laptop loopback: authenticate tools/call (discovery/tools/list can stay open; execution and data retrieval must not), authorize per tool rather than per server, and bind listeners to localhost or a private network unless there is a deliberate reverse-proxy with auth in front. Scan your own external attack surface for MCP fingerprints before attackers do. Treat any MCP server that wraps exec, SQL, CMS writes, or citizen/PII workflows as a Tier-0 interface — same identity, authorization, and logging you would demand of an admin API. If you unexpectedly ran an MCP server on 0.0.0.0 during a demo, shut it down and rotate every secret that process could read. Prefer allowlisted local stdio MCP servers over ad-hoc remote HTTP/SSE endpoints for developer agents.

## How do I find every machine running Not a single-product CVE — operational exposure of remotely reachable MCP servers that skip authentication on tools/c?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Not a single-product CVE — operational exposure of remotely reachable MCP servers that skip authentication on tools/c and which version, then enforce a policy on it.

## References

- article: https://pluto.security/blog/wide-open-hundreds-of-mcps-exposing-root-shells-production-data-and-citizen-records-one-call-away/

## Related vulnerabilities

- [GHSA-53mr-w429-c597](https://catalog.anomity.ai/vuln/ghsa-53mr-w429-c597) — high
- [CVE-2026-114090](https://catalog.anomity.ai/vuln/cve-2026-114090) — high
- [GHSA-7xgj-8392-5q4r](https://catalog.anomity.ai/vuln/ghsa-7xgj-8392-5q4r) — medium
- [CVE-2026-114612](https://catalog.anomity.ai/vuln/cve-2026-114612) — critical
- [CVE-2026-103091](https://catalog.anomity.ai/vuln/cve-2026-103091) — critical
- [CVE-2026-109527](https://catalog.anomity.ai/vuln/cve-2026-109527) — high

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=pluto-operation-mcp-147-of-179-internet-facing-mcp-servers-accepted