Threat · curated 26 Sep 2026
From Debugging to Code Execution: RCE in Microsoft DevLabs’ DebugMCP?
First reported imperva.com
Coverage timeline
Single-source incident — first reported, latest, and curated coincide.
Why it matters
DebugMCP's unauthenticated local MCP server exposes developers to drive-by remote code execution through DNS rebinding, illustrating a recurring class of MCP server vulnerabilities that defenders must patch and audit in AI-assisted development environments.
Imperva Threat Research disclosed a critical RCE in Microsoft DevLabs' DebugMCP (v1.1.4), an MCP server that gives AI agents like Copilot, Cursor, and Cline direct control over the VS Code debugger. The server auto-starts and listens on port 3001 without authentication; via DNS rebinding, a remote attacker could achieve arbitrary code execution simply by luring a developer to a malicious webpage. Microsoft silently patched the flaw (commit 86776b2) in version 1.2.0 and later.