Full Report
How unauthenticated Model Context Protocol (MCP) servers are opening doors to sensitive cloud data, IAM, and command execution.
Analysis Summary
# Vulnerability: Exposure of Unauthenticated Model Context Protocol (MCP) Servers
## CVE Details
- **CVE ID**: Not yet assigned (Protocol-level architectural weakness)
- **CVSS Score**: Estimated 9.8 (Critical) based on unauthorized access to high-privilege systems.
- **CWE**:
- CWE-287: Improper Authentication
- CWE-306: Missing Authentication for Critical Function
- CWE-918: Server-Side Request Forgery (SSRF)
## Affected Systems
- **Products**: MCP (Model Context Protocol) Servers and AI Agent implementations.
- **Versions**: Servers utilizing the original protocol spec (2024-11-05).
- **Configurations**: Any MCP server exposed to the public internet without an authentication layer (e.g., reverse proxy or middleware). Significant exposure found in environments running MCP (approx. 1 in 6).
## Vulnerability Description
The Model Context Protocol (MCP) is a standardized interface for AI agents to interact with external tools and data. Many early implementations lack baked-in authentication (a feature only added to the spec in March 2025).
Attacker reconnaissance is facilitated by the protocol's `tools/list` handshake, which automatically provides a machine-readable catalog of all available functions and parameter schemas. Vulnerable servers act as "privileged proxies," where the server uses hardcoded credentials to access backends (databases, internal APIs, cloud metadata) but fails to verify the identity of the client calling the MCP endpoint.
## Exploitation
- **Status**: PoC available / Actively scanned in the wild (Wiz Research confirmed active scanning of 500+ orgs).
- **Complexity**: Low (Handshake is standardized; generic clients can be used to scan any server).
- **Attack Vector**: Network (Internet-accessible endpoints).
## Impact
- **Confidentiality**: **High** - Exposure of employee PII, retirement account balances, internal issue trackers, and security program data.
- **Integrity**: **High** - Some servers allow write and delete operations on production systems.
- **Availability**: **Medium** - Potential for service disruption via unauthorized administrative commands.
- **Cloud IAM**: **Critical** - SSRF vulnerabilities allow attackers to query cloud metadata endpoints and retrieve temporary IAM credentials.
## Remediation
### Patches
- **Update Protocol Version**: Implement the updated MCP specification (post-March 2025) which includes native support for authentication/authorization.
- **Vendor Specific**: Ensure all AI agent wrappers and MCP server implementations are updated to the latest vendor releases.
### Workarounds
- **Network Isolation**: Do not expose MCP servers directly to the public internet. Use VPNs or private networks.
- **Access Control**: Implement a reverse proxy (e.g., Nginx, OAuth2 Proxy) with strong authentication (mTLS or OIDC) in front of the MCP endpoint.
- **Least Privilege**: Configure the backend credentials used by the MCP server with the minimum permissions necessary (read-only where possible).
## Detection
- **Indicators of Compromise**:
- Unexpected incoming requests to common MCP paths (e.g., JSON-RPC calls to `tools/list` or `resources/list`).
- Unusual output from cloud metadata endpoints indicating unauthorized credential harvesting.
- **Detection Methods and Tools**:
- Use network scanners to identify internal assets listening on MCP-standard ports.
- Audit AI infrastructure for unauthenticated endpoints.
## References
- [Wiz Blog: The risk hiding behind exposed MCP servers] - hxxps://www[.]wiz[.]io/blog/the-risk-hiding-behind-exposed-mcp-servers
- [MCP Security Documentation] - hxxps://modelcontextprotocol[.]io/docs/tutorials/security/authorization
- [Wiz State of AI in the Cloud 2026 Report] - hxxps://www[.]wiz[.]io/reports/state-of-ai-in-the-cloud-2026