The malicious payload remains dormant during the first two tool calls, and then the metadata descriptions turn into instructions to steal SSH keys and AWS credentials.
The campaign tracked under the name Deadbugz illustrates a structural weakness in the MCP server supply chain: control takes place before deployment, behavior changes after. A single account filed 23 pull requests in unrelated AI and developer tooling projects in 74 minutes, each proposing the addition of an MCP server presented as a text formatting and summarizing utility.
Upon installation, the server delivers on its promise. The malicious payload remains dormant during the first two tool calls, then activates on the third: the metadata descriptions then turn into instructions to retrieve SSH keys, AWS credentials, shell history, and Kubernetes configurations, hiding the operation from the user. Lag is the heart of the attack, since a code review done before release only sees a harmless tool.
Three MCP server CVEs in parallel
In the same month, three separate vulnerabilities were published on MCP servers: CVE-2026-73498 at Atlassian, a path traversal allowing the reading of arbitrary files; CVE-2026-67357 on ArcadeDB, a plaintext cluster token disclosure; and CVE-2026-19956 on the Facebook Ads server, a server-side request forgery. None are specific to the models: they are classic web application flaws, which suggests that MCP servers mostly inherit the ordinary security problems of the infrastructure. The resulting recommendation is run-time monitoring of tool metadata changes after approval, since preflight cannot structurally detect them.
Read the full article on the original source
Go to the source →