Security1 hOctober 4, 2026, 08:47

Four MCP servers hit by unauthenticated CVEs in 48 hours

Between September 14 and 15, NVD published four CVEs for MCP servers scoring 9.8 to 10.0: Bifrost, mysql-mcp-server, IBM's mcp-contextforge-gateway and @zereight/mcp-gitlab. All four expose tools without authentication, and fixes for two of them shipped back in June.

DEV Community

Open source

Four MCP servers hit by unauthenticated CVEs in 48 hours

CVE-2026-59971 and CVE-2026-53710 carry the maximum CVSS score of 10.0
CVE-2026-90898 in Bifrost and CVE-2026-61560 in mcp-gitlab are rated 9.8
Fixes for two of the flaws were tagged in June, three months before the CVE records
LiteLLM's MCP auth bypass has been on CISA's KEV list since September 2

#IBM#GitLab#MySQL#MCP

CVE-2026-85706: unauthenticated file read in GitLab exploited

IBM brings Bob to self-hosted and air-gapped environments

Software

GitLab 19.4 adds agentic automation tools

Science

Four MCP servers hit by unauthenticated CVEs in 48 hours

CVE-2026-85706: unauthenticated file read in GitLab exploited

IBM brings Bob to self-hosted and air-gapped environments

GitLab 19.4 adds agentic automation tools

Four astronauts reach ISS in 8 hours, setting US speed record