What question did this study set out to answer?

This research aims to analyze the vulnerability landscape of the Model Context Protocol (MCP) system.

April 17, 20260 citationsOpen Access

30 CVEs in 60 Days: The Model Context Protocol Attack Surface

Key Points

This research aims to analyze the vulnerability landscape of the Model Context Protocol (MCP) system.
Empirical analysis of the MCP attack surface
Scanning an ecosystem of 96,096 skills
Identifying 1,302 threat indicators
Classifying attacks into 7 distinct categories
Conducting deep dives into six critical vulnerabilities
Identified 30 CVEs in 60 days, significantly faster than Docker
38% of vulnerabilities showed zero authentication requirements
Highlighted critical vulnerabilities with CVSS scores 9.6 and 9.4

Abstract

Empirical analysis of the MCP attack surface. 30 CVEs in 60 days (15x faster than Docker), 38% zero authentication, 7-class attack taxonomy. Ecosystem scan of 96,096 skills with 1,302 threat indicators. Six critical vulnerability deep dives including CVE-2025-6514 (CVSS 9.6) and CVE-2025-49596 (CVSS 9.4).

Ask AI

Helpful

Bookmark

View Full Paper