Unverified50% confidenceEventExact time
Obsidian Security documented a confused deputy attack: the MCP server acts as both an OAuth client and an authorization server, uses a static shared client ID, and the attacker redirects the code to their own infrastructure to obtain a valid access token.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/22/2026
First Seen
Valid until: 1/20/2027
Sources
Related Entities
Related Claims
UnverifiedDisclosed MCP vulnerabilities include: argocd-mcp shipped with no authentication at all, Rill's OAuth flow allowed attackers to skip the user consent step, and prompt injection existed in the tool descriptions of multiple MCP servers.74% similarUnverifiedA single compromised MCP server can execute prompt injection, credential exfiltration, delivery of phishing toolkit fingerprints, PII leakage, token theft via OAuth, and SSRF attacks.74% similarUnverifiedIn the Langflow vulnerability, attackers log in as an ordinary non-admin user, add an MCP server whose command field contains a malicious payload, the server accepts and stores the command without validation, and code execution is then triggered by fetching the MCP server list; captured payloads include extracting environment variables, reading /etc/passwd and probing with commands such as id and whoami.72% similarUnverifiedPrompt injection is a security vulnerability unique to LLM applications, where attackers can embed malicious instructions in tool results returned by an MCP server to manipulate agent behavior.70% similarUnverifiedWithout rigorous authentication, permission isolation, and input validation, a hijacked agent may cause damage to backend systems via an MCP server.70% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1085487API
curl https://kongchang.com/api/v1/knowledge/claims/1085487MCP
get_claim(id=1085487)