Known vulnerabilities in MCP servers, 2026 Q3

Inherited exposure is almost six times direct exposure

152 tracked MCP servers carry a known CVE of their own. 869 servers inherit one through a dependency that is itself a tracked MCP server, up to three hops away. That is almost six inheriting servers for every server with a direct CVE (869 / 152 = 5.7).

This count is a floor. It follows only dependencies the observatory tracks as MCP servers, so a CVE in a general npm or PyPI library does not appear in it. An inherited CVE is a reason to check the dependency chain; whether the vulnerable code is actually reachable needs its own review.

Known CVEs cluster on a small group of servers

The 889 known CVEs sit on 152 of the 57,246 servers the observatory tracks, 0.27% of them (152 / 57,246). Within that group they are far from evenly spread: the top 1% of affected servers hold 32% of all known CVEs, and the top 10% hold 70%.

If you depend on one of those servers, a single upgrade can close a large share of the advisories at once. A server without a known CVE simply has nothing on record in the sources this report reads.

Six in ten known CVEs are rated critical or high

Of the 889 CVEs, 145 are rated critical and 389 high: 534 in total, or 60% (534 / 889). A further 311 are medium, 36 low and 8 carry no severity rating.

Severity describes the damage if a flaw is exploited. How likely exploitation is, FIRST EPSS estimates as a probability: 0.1 or higher for 14 of the 889 CVEs, and 0.5 or higher for 6. Advisories whose applicability to the running version is unknown are counted, as the methodology explains.

Nearly two in three npm and PyPI servers lack a provenance attestation

1,467 of the 4,073 MCP servers published on npm or PyPI carry a provenance attestation, 36% (1,467 / 4,073). For the other 2,606, the registry offers no attestation linking the published package to the source it was built from.

A missing attestation is not evidence of tampering. It removes one cheap check you could otherwise make before installing.

Methodology

Servers the observatory tracks: a source tree was read, and the server was not analysed and found to have no MCP interface.

Advisories proven not to apply to the version a server runs are excluded; advisories of unknown applicability are counted.

Inherited exposure counts only dependencies that are themselves tracked MCP servers, up to three hops; CVEs in general npm or PyPI libraries are not included.

Sources: OSV.dev, GitHub Security Advisories, FIRST EPSS, npm, PyPI. How each signal is collected is described on the methodology page. Every number on this page is frozen as of the date above and will not change.