CVE-2025-6514
CVSS 9.6 CRITICAL: mcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the… EPSS 77% (100th percentile).
AI · 57 days ago
MCP servers are emerging as privileged middlemen for AI agents, and researchers say that model context protocol (MCP) setups can leak enterprise secrets through plaintext configs, over-permissioned access, and prompt injection. The concrete flaw is CVE-2025-6514 in mcp-remote, where a malformed server connection can trigger OS command injection on the client side.
The risk is bigger than one bad connector. MCP helpers often carry real credentials and tokens for cloud, docs, APIs, and internal tools, so if the bridge is misconfigured or exploited, an attacker can reach both commands and the keys the bridge was meant to protect. That makes the connector layer part of the trust boundary, not a harmless plugin, for any team running AI agents against live systems.
CVSS 9.6 CRITICAL: mcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the… EPSS 77% (100th percentile).
1 source covering this story
How MCP Servers Can Expose Enterprise Secrets
MCP servers can leak enterprise secrets through plaintext config files or prompt injection.
Part of the PlainSec briefing for 2026-08-17