A CVSS 9.9 flaw in LiteLLM lets an authenticated internal user forge an administrator token because the proxy reuses one encryption context for stored secrets and session tokens. Admin access leads to commands on the host through the MCP stdio endpoint. Fixed in four stable lines and one release candidate.
A Censys scan found 12,520 publicly exposed MCP services — 40% with no authentication at all. Combined with 106 zero-days found in an automated academic scan and a CVSS 10.0 flaw in a popular MCP server, the AI agent infrastructure layer is becoming one of 2026's most under-patched attack surfaces.
The NSA AISC's May 2026 CIS on MCP security: authentication gaps, tool poisoning via unsigned dynamic discovery, session-identity binding failures, and compensating controls.