AI 에이전트가 회사 내부에서 서로 대화를 나누는 시대가 왔습니다. 그런데 이 대화 통로인 MCP 보안에 구조적인 허점이 있다는 사실, 알고 계셨나요? 최근 구글을 비롯한 여러 조직에서 MCP 취약점이 실제로 발견됐고, 공격자가 에이전트 사이의 신뢰 관계를 악용해 악성 지시를 퍼뜨릴

 A high-severity security vulnerability in the official Model Context Protocol (MCP) Python SDK could allow malicious MCP servers to steal OAuth credentials from artificial intelligence applications. Tracked as GHSA-qx49-fqc8-xw99, the flaw has a CVSS score of 7.5 and affects HTTP-based MCP clients that use OAuth authentication while connecting to servers that are not fully trusted. The issue does not affect local studio clients, MCP servers, or applications that provide their own authentication tokens and headers.  The vulnerability is linked to the SDK’s OAuth discovery process. During authentication, an MCP client asks a server to identify the authorization server responsible for issuing tokens. A malicious server could return a 404 response for the standard OAuth discovery endpoint, forcing the SDK to use a fallback method. On this unsafe path, the SDK failed to properly validate the authorization server’s issuer, allowing the attacker to redirect the authentication flow to an infrastructure controlled by them.  As a result, attackers could capture an OAuth client secret, authorization code and PKCE proof key. These credentials may enable the attacker to obtain valid access tokens from the legitimate identity provider, potentially gaining the same permissions as the affected application. Depending on the configured OAuth scopes, the impact could include access to cloud services, internal APIs, databases, deployment systems and other connected resources. Long-lived client secrets and refresh tokens could also support continued access or account takeover.  The affected releases include MCP Python SDK versions 1.9.1 through 1.29.1 and versions 2.0.0 through 2.1.1. The maintainers fixed the issue in version 1.30.0 for the 1.x branch and version 2.2.0 for the 2.x branch. However, upgrading alone may not be sufficient for deployments using ClientCredentialsOAuthProvider or PrivateKeyJWTOAuthProvider; developers must explicitly configure the expected issuer= value. Users of the deprecated 1.x RFC7523OAuthClientProvider should migrate to another supported provider.  Organizations should immediately identify affected clients, upgrade the SDK and remove stored OAuth client registrations created by older releases. If a vulnerable client connected to an untrusted MCP server, administrators should rotate client secrets, revoke potentially exposed tokens and review authentication logs for suspicious activity. Teams unable to upgrade should restrict connections to MCP servers they completely control and trust. The advisory highlights the security risks created when AI agents connect external tools to privileged enterprise systems, making strict server verification and issuer validation essential safeguards.

GreyNoise deployed MCP honeypots to see what happens when AI middleware meets the open internet — revealing how attackers interact with this new layer of AI infrastructure.

Two more Model Context Protocol Security Flaws

Pentagon AI deals, Oscars ban AI credits, Meta buys robotics startup, Word gets legal agent, MCP risk, Replit growth. AI News.

Learn about mcp security practices that ensure safe access and auditing when deploying MCP servers in your organization.

Uncover the key features of the Obot MCP platform and why it is essential for modern enterprise data integration and security.

Zuplo is hosting a no-cost workshop on how teams are preparing for the rise of AI agents by turning their APIs into MCP servers, without compromising on…