Official MCP Python SDK Flaw Can Let Malicious Servers Steal OAuth Credentials
2026-09-29T07:23:59Z•7cd7e5e95eef2e9c36abffebcf543ae299c908f79095f6450b0dfef9accf5a4e
CVE-2026-35273CVE-2026-48842CVE-2026-65660CVE-2026-86950CVE-2026-88771AI agentsAndroid banking trojanAzureCI/CD securityCISA KEVCitrix NetScalerDockerMCPOAuthOracle PeopleSoftRoundcubeSharePointWordPressactive exploitationbotnetcloud securitycredential theftcryptocurrency theftknown exploited vulnerabilitiesmacOS malwaremalwareremote code executionsupply chain compromiseweb shellzero-day
What happened
The feed highlights widespread active exploitation and high-impact cyber threats, including critical Citrix NetScaler, Oracle PeopleSoft, SharePoint, MikroTik RouterOS, Roundcube, and Apple vulnerabilities; credential theft through a malicious MCP Python SDK server; targeted malware campaigns; cloud and CI/CD compromise; destructive Azure operations; and major cryptocurrency theft. Several vulnerabilities are reported as actively exploited or listed in CISA's KEV catalog, while emerging AI-agent abuse and governance risks are also prominent.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- 7cd7e5e95eef2e9c36abffebcf543ae299c908f79095f6450b0dfef9accf5a4e
- Enrichment time
- 2026-09-29T07:23:59Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.