Five Teams Fixed the Same MCP Bug. Five Federal Filings Are Still Open.

US X trends on 5 October were football and celebrity. Saints, Joe Mixon, and Monday Night Football led the list. Hacker News led with Reflection's Beam model, which also trended, and with a GitHub Actions outage GitHub marked resolved at 22:49 UTC. The root cause is still unwritten. None of that is a control failure.

The operator piece is Dan Goodin in Ars Technica the same day. Independent researcher Syed Anas Mohiuddin says five organizations that share a protocol, not a codebase, each confirmed and fixed the same server-side request mistake in an MCP server. Five filings against US federal MCP servers have been in triage since 2 September. He is not calling those confirmed.

High High because GHSA-3x3x-8ffg-ghcv is public at CVSS 4.0 8.0, and because five federal reports are still open. Not because those federal reports are confirmed breaches.

What Ars and the researcher actually said.#

The primary is Mohiuddin's update, Protocol Pivoting, four months later, dated October 2026 on his site. Ars is the wire that moved it on 5 October. In May he had one example and a prediction: if the gap is structural, it shows up in servers whose teams share nothing. It did.

He names five server-side request fixes, each confirmed by that organization's own security team:

1. Google's MCP Toolbox for Databases, googleapis/mcp-toolbox. The HTTP client shipped without a restrictive redirect policy and without a check on the address it would actually connect to. Pull request 3448 merged on 18 June 2026. It checks resolved addresses at connection time, applies IP allow and block lists, and rejects an unsafe base URL at startup. CVE-2026-14540 was reserved on 3 July and the advisory was published on 31 July. GitHub marks it high. CVSS 4.0 is 8.0. CVSS 3.1 on the same advisory is 6.1. Ars quoted 8.
2. JPMorgan Chase. A documentation-search server has one tool that allowlists the domain before it fetches, and a sibling that fetches a caller-supplied URL with no restriction. The bank's disclosure team confirmed it. A fix is deployed. He rates it medium, and there is no CVE, because no credential rides with the request.
3. Weaviate. Pull request 12961 constrains the Google module's endpoint, region, and location to Google API hosts. The hall of fame entry is dated 25 August 2026.
4. France's DINUM, on datagouv/datagouv-mcp. A URL field supplied by data producers was fetched in a way open to DNS rebinding. Pull request 126, "harden SSRF on external APIs," merged on 4 September 2026.
5. Tangerang City's Wazuh MCP server. A check rejected literal IP addresses and never resolved hostnames. He reported it on 2 September. Advisory GHSA-pw2j-pj4h-f5vg was published on 3 September, rated high.

Rapid7 is the sixth name and a different bug. CVE-2026-97228 covers Bulk Export MCP 0.2.5 through 0.6.1. An export identifier reached a GraphQL query with no validation. Fixed in 0.6.2, published 25 September, CVSS 3.1 of 2.7. Rapid7 says the query stays inside the operator's own API key and cannot cross a tenant. The path they describe is a compromised or careless upstream client, or indirect prompt injection handing the identifier across. Ars's "fixed last month" matches that calendar.

The federal clock is the one that has not moved. On 2 September he filed five private GitHub security advisories: a Department of Veterans Affairs benefits-claims server, a CMS Blue Button server, a regulations.gov server, a USASpending server, and a CDC PLACES server, all under GSA's Technology Transformation Services. All five were still in triage when he wrote the October update. He is credited as reporter. He is not presenting them as confirmed.

At class level, the VA case is the second failure mode, not another forgery. When the upstream benefits API returns an error, the server logs the full response body. Those bodies can hold identity data, and ordinary validation failures are enough to produce them. He withheld the code on purpose. This brief does too.

Japan's Digital Agency is a similar open item, also unconfirmed. He reported missing authentication to JPCERT on 1 September. Public pull request 6, which refuses to listen beyond loopback unless someone opts in, has not merged.

What Mohiuddin calls protocol pivoting is the hallway, described here without a procedure. Text comes back from a tool. An orchestrating agent treats it as a task and hands it to another agent. That agent trusts the sender. If it holds a tool that can send a request or take a privileged action, the action now comes from inside the trust boundary. He is explicit that the pattern does not depend on request forgery. Forgery is just the outbound tool he keeps finding. No single component has to be compromised in the classic sense. Each one did what it was built to do.

Package clock versus impact clock.#

The package clock is a list of merges. Google's guard landed 18 June, and the label arrived 31 July. Weaviate's hall of fame entry is 25 August. Tangerang's advisory is 3 September, about a day after the report. DINUM's pull request merged 4 September. Rapid7's fix is 0.6.2, with the CVE on 25 September. JPMorgan says a fix is deployed and has not published a CVE.

The impact clock is everything that list does not cover. Five federal filings from 2 September were still in triage in the update Ars used. Japan's pull request is still open. Every other MCP server that fetches from a tool argument, or writes an upstream body into a log, is on this clock until someone reads that server. Bumping mcp-toolbox does not move it.

1. 2026-06-18
   Google merges pull request 3448, the SSRF guard in mcp-toolbox. The May argument that predicted the pattern has no numbered day.
2. 2026-07-03
   CVE-2026-14540 is reserved. The advisory publishes on 31 July at CVSS 4.0 8.0 and CVSS 3.1 6.1.
3. 2026-08-25
   Weaviate's hall of fame dates the Google-module finding.
4. 2026-09-02
   Five US federal advisories are filed. Tangerang is reported the same day. The federal five stay in triage.
5. 2026-09-25
   Rapid7 publishes CVE-2026-97228 at 2.7, fixed in Bulk Export MCP 0.6.2.
6. 2026-10-05
   Ars Technica reports the cross-vendor pattern. MCPCon North America, where he plans to present it, is 23 October.

What this is not.#

It is not one campaign and not one vulnerable version. It is not proof that the five federal servers were breached, or that an attacker used the hallway against them. He says the opposite about confirmation, and he kept the code private.

It is not a dependency-scanner miss you can close by refreshing a lockfile. He also published mcp-safeguard and then wrote that pattern-matching tools, his included, miss a large share of this class. A new scanner is not the control.

It is not the reference fetch SSRF, and it is not a reason to treat every MCP server on the internet as guilty. The confirmed list is five request-forgery fixes plus one low-severity query bug. The open list is five federal filings and one Japanese pull request, all explicitly unconfirmed.

What to do.#

If you run agents that call MCP servers, the work is on the servers you operate, not on Ars's headline:

1. Inventory every MCP server that fetches a URL, path, or endpoint from a tool argument, and every server that logs an upstream body. Composition analysis will not produce this list.
2. If you run googleapis/mcp-toolbox, confirm the build contains the 18 June guard, not merely a version newer than the day you first installed it. Then stop. That confirmation does not cover the next server.
3. Put the same allowlist on every tool that fetches. JPMorgan's case is the pattern: the first tool had the check, the sibling did not. The fork from an AWS original had added the fetch and dropped the list.
4. Validate the address at connection time, not only before DNS can change. Reject an unsafe base URL when the process starts. Turn off automatic redirects, or check every hop. Google's merged pull request is the reference, not a unique snowflake.
5. Redact upstream error bodies before they reach centralized logs. That is the federal class. Ask the owners of those five servers. Do not probe them, and do not brief the filings as incidents.
6. Treat tool arguments and tool output as untrusted input. A delegated task is not a trust upgrade. Vervier's correction stands: this is indirect prompt injection with a protocol in the middle.

The X Trends this evening were a football game. The Ars piece is why an unconfirmed federal triage queue is on this page. The packages that already merged are the easy clock. The servers nobody has read are the one that is still running.