30 CVEs in 60 Days: The Model Context Protocol Attack Surface

Key Points

• This research aims to analyze the vulnerability landscape of the Model Context Protocol (MCP) system.
• Empirical analysis of the MCP attack surface
• Scanning an ecosystem of 96,096 skills
• Identifying 1,302 threat indicators
• Classifying attacks into 7 distinct categories
• Conducting deep dives into six critical vulnerabilities
• Identified 30 CVEs in 60 days, significantly faster than Docker
• 38% of vulnerabilities showed zero authentication requirements
• Highlighted critical vulnerabilities with CVSS scores 9.6 and 9.4