CVE-2026-9680

Published: Jul 28, 2026Modified: Jul 28, 2026

5.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: CNA (Secondary)

Description

Improper exposure of the MCP server in alibabacloud-rds-openapi-mcp-server allows remote attackers to invoke exposed MCP tools via network access to an MCP endpoint listening on all network interfaces by default.

Related CWEs

CWE-1188

Initialization of a Resource with an Insecure Default

The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.

References (1)

https://github.com/aliyun/alibabacloud-rds-openapi-mcp-server

Source: alibaba-cna@list.alibaba-inc.com

Timeline

No history available yet.