Threat · curated 17 Sep 2026
MCP Server Exploits: From Vulnerability to Enterprise Risk
First reported pluto.security
Coverage timeline
Single-source incident — first reported, latest, and curated coincide.
Why it matters
MCPwnfluence demonstrates that third-party MCP servers connecting AI agents to enterprise tools like Jira and Confluence are being weaponized in the wild within weeks of disclosure, turning AI integrations into RCE entry points into enterprise environments.
Pluto Research reports that a working exploit for MCPwnfluence — a chain of two vulnerabilities (CVE-2026-27825 and CVE-2026-27826) in the popular mcp-atlassian MCP server — appeared on the Russian-language cybercrime forum XSS.PRO just 20 days after the patch and six days after NVD publication. The chain lets attacker-controlled content be written to arbitrary locations on unauthenticated network-accessible deployments, yielding remote code execution, and similar activity against nginx-ui and Flowise shows attackers actively targeting third-party AI components.
Summary
A working exploit for MCPwnfluence — a chain of two vulnerabilities (CVE-2026-27825 and CVE-2026-27826) in the popular mcp-atlassian MCP server — appeared on XSS.PRO, a Russian-language cybercrime forum, just 20 days after the patched version was released and only six days after the CVEs were published to the NVD. The forum post described a complete malicious request chain demonstrating end-to-end exploitation leading to remote code execution.[1]
The activity is not isolated: Pluto documents the same rapid weaponization pattern across other MCP-related components, including CVE-2026-33032 in nginx-ui (identified as actively exploited in March 2026 and added to VulnCheck's KEV catalog) and CVE-2025-59528 in Flowise (a CVSS 10.0 flaw with exploitation attempts detected via VulnCheck's Canary network). Collectively these cases indicate attackers are actively targeting third-party AI/MCP components as a route into enterprise environments.[1]
Attack chain
- Initialize an MCP session: The attacker connects to the MCP server over HTTP and obtains a valid MCP session ID. In affected network-accessible deployments the server accepted requests without authentication.[1]
- Redirect the Confluence connection (CVE-2026-27826): The attacker supplies a spoofed X-Atlassian-Confluence-Url header pointing to an HTTP server they control, causing the MCP server to retrieve attacker-controlled content instead of a legitimate Confluence attachment.[1]
- Write payload to a sensitive location (CVE-2026-27825): The attacker invokes the confluence_download_attachment tool with an unrestricted download_path (e.g. /etc/cron.d/cron_file). The vulnerable server writes downloaded content to that path without validating whether it is safe, giving the attacker control over both the content source and its filesystem destination.[1]
- Wait for execution: Once the malicious cron file is written, the attacker waits for the scheduled job to run and connect back to their listener, turning an AI tool call into code execution on the host.[1]
Disclosure timeline
| Date | Event |
|---|---|
| February 24 | Maintainer released patched mcp-atlassian version 0.17.0.[1] |
| February 26 | Pluto published its original MCPwnfluence research.[1] |
| March 10 | CVE-2026-27825 and CVE-2026-27826 appeared on the NVD.[1] |
| March 16 | A working criminal proof-of-concept exploit appeared on the XSS.PRO cybercrime forum — 20 days after the patch and six days after NVD publication.[1] |
| March 2026 | Recorded Future identified nginx-ui CVE-2026-33032 as actively exploited; it was later added to VulnCheck's KEV catalog.[1] |
How it works
MCPwnfluence chains a server-side request forgery with an unrestricted file write, compounded by missing authentication on network-accessible deployments. CVE-2026-27826 lets an attacker redirect the MCP server's outbound requests via a spoofed X-Atlassian-Confluence-Url header, and CVE-2026-27825 lets the confluence_download_attachment tool write downloaded content to an arbitrary path such as /etc/cron.d/cron_file. Controlling both the content source and destination allows an attacker to plant a cron job that executes as code on the host.[1]
The related cases share the same class of failure: nginx-ui exposed a powerful MCP message endpoint without an authentication check, allowing anyone reachable to read and modify nginx configurations and reload the server. Flowise passed user-supplied MCP server configuration into JavaScript's Function() constructor, treating configuration data as executable code and permitting command execution on the Flowise host.[1]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| mcp-atlassian MCP server | Versions prior to 0.17.0 (network-accessible deployments accepting unauthenticated requests are especially at risk) | Patched in version 0.17.0, released February 24; organizations should upgrade to 0.17.0 or later immediately.[1] |
| nginx-ui | Deployments with the MCP message endpoint lacking authentication (CVE-2026-33032) | Security advisory published; vulnerability added to VulnCheck's KEV catalog after active exploitation was identified.[1] |
| Flowise (CustomMCP component) | Versions vulnerable to CVE-2025-59528 (CVSS 10.0) | Patch available; exploitation attempts detected more than six months after the patch became available.[1][2] |
Indicators of Compromise
| Type | Indicator | Context |
|---|---|---|
| cve | CVE-2026-27825 | mcp-atlassian arbitrary file write allowing downloaded content to be written to an arbitrary location; part of the MCPwnfluence chain with a criminal PoC circulating.[1][3] |
| cve | CVE-2026-27826 | mcp-atlassian request-redirection (SSRF) flaw allowing the MCP server's requests to be redirected to an attacker-controlled server; part of the MCPwnfluence chain.[1][4] |
| cve | CVE-2026-33032 | nginx-ui MCP message endpoint missing authentication; identified as actively exploited and added to VulnCheck's KEV catalog.[1][5] |
| cve | CVE-2025-59528 | Flowise CustomMCP CVSS 10.0 code-execution flaw via Function() constructor; exploitation attempts detected by VulnCheck's Canary network.[1][6] |
| file-path | /etc/cron.d/cron_file | Destination path used in the demonstrated PoC to write a malicious cron job for code execution on the host; defenders can monitor for unexpected writes to cron directories.[1] |
| other | X-Atlassian-Confluence-Url HTTP header | Attacker-supplied header used to redirect the mcp-atlassian server to a controlled endpoint; anomalous or externally supplied values of this header indicate exploitation attempts.[1] |
Key takeaways
- Vulnerabilities in third-party AI/MCP components are being weaponized rapidly — the MCPwnfluence criminal PoC appeared just 20 days after the patch and six days after NVD publication, leaving vulnerability programs that wait for NVD listings almost no lead time.[1]
- Across mcp-atlassian, nginx-ui, and Flowise the underlying bugs are familiar (missing authentication, SSRF, unrestricted file write, code evaluation), but their placement inside high-privilege AI integrations makes them a meaningful new path into enterprise environments.[1]
Defensive actions
- Upgrade mcp-atlassian to version 0.17.0 or later immediately.: The patched version fixes the CVE-2026-27825/27826 chain exploited by the criminal PoC; a patch only helps when teams know the affected software is running.[1]
- Inventory every MCP server in the environment and review its network exposure.: Adoption is outpacing organizations' ability to discover and govern MCP components, and attackers target deployments organizations may not know are still running.[1]
- Restrict MCP servers' filesystem and network permissions and require authentication on their endpoints.: The exploited flaws stemmed from missing authentication, SSRF, and unrestricted file writes; limiting permissions reduces the ability to reach the host or write to sensitive locations like /etc/cron.d.[1]
- Stop treating locally installed AI integrations as harmless plugins and monitor MCP endpoints for anomalous headers and file writes.: MCP servers combine access to internal data, credentials, local file read/write, and trusted network positions, making them an attractive bridge from agent tooling to host-level compromise.[1]