Skip to content
Cognivators
Research

The public record, with the primary source next to every claim.

Each entry below was checked against the CVE record or the vendor's own repository. Ratings are stated as the CNA or vendor assigned them, including the low ones.

Write-ups

Findings with a full account.

  1. CVE-2026-14540

    Google · 2026-07-31

    Server-side request forgery via unrestricted HTTP redirection in MCP Toolbox

    The HTTP source in Google's MCP Toolbox followed redirects without validating where they led, so a crafted path parameter could make the server call internal or arbitrary external endpoints.

    8.0 High (CVSS 4.0, assigned by Google)

  2. CVE-2026-97228

    Rapid7 · 2026-09-25

    GraphQL query injection in the export status lookup of Rapid7 Bulk Export MCP

    An MCP tool argument was placed straight into a GraphQL query string, so a crafted identifier could append extra selections to the query. Rated Low, and published because the pattern is common in MCP servers.

    2.7 Low (CVSS 3.1)

  3. github-mcp-server PR #3056

    GitHub · 2026-08-18

    Attach the GitHub token only to configured GitHub hosts

    A transport re-added the Authorization header on every redirect hop. We wrote the patch that keeps the token on GitHub's own hosts. GitHub merged it as hardening, not as a response to a known exploit.

    Hardening change, no CVE

Other public records

Fixes and advisories, listed with their status.

Facts only. For the Weaviate and JPMorgan Chase entries, the fix was written and merged by the vendor's own team.

  1. Weaviate

    weaviate/weaviate PR #12961

    Restrict the Google module apiEndpoint, region and location to Google API hosts.

    Fix merged by the Weaviate team, 2026-09-07

    Primary record

  2. JPMorgan Chase

    jpmorgan-payments/ai PR #19

    Enforce the domain allowlist in related(), closing an SSRF path.

    Fix merged by the JPMorgan Chase team, 2026-09-18

    Primary record

  3. 1Password-MCP (community project)

    GHSA-q3gg-rgxh-gh64

    op_run leaked the OP_SERVICE_ACCOUNT_TOKEN master credential to subprocesses and model context.

    Advisory published 2026-09-01, severity High, finder credited. No CVE assigned.

    Primary record

Not listed here

What we leave out, and why.

Two further vulnerabilities were confirmed and fixed by Amazon Web Services. They stay unnamed under our written agreement with AWS. Anything still in coordinated disclosure is not described until the vendor publishes.