ACVE-2026-0422

In the wild

weaponised-poc · 2026-07-13 – 2026-07-13 · dfir

Description

What

SANS ISC documented internet reconnaissance for .claude, .cursor, .vscode/mcp.json, .mcp/config.json, and MCP endpoint paths. The observed request volume is active reconnaissance, not proof that a target was compromised. The row captures a reachable remote MCP configuration as a static exposure condition.

Which configuration is exposed

A local setup is exposed when an MCP server URL host is non-loopback or agent configuration files are served from a web root. The matcher covers the MCP half because lock discovery cannot see arbitrary web roots; operators must separately remove credential files from published content.

How ACVE detects it

ACVE checks one mcpServers element for a present host that is not localhost, 127.0.0.1, or ::1. It does not make network requests or prove that a web server exposed the file. Missing host data is possible.

Fix

Remove credentials and configuration files from web roots, rotate any tokens that were reachable, bind MCP services privately, and require authentication for intentional remote transport. Review access logs for the paths named by SANS.

Grounding needed

The SANS diary should be checked for the 14-day observation window, request paths, and source-IP count. Recon evidence supports weaponised intent but not a confirmed victim.

This record is limited to the condition named in the public source: Internet scanning targets agent config files and MCP endpoints. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.

Configuration

some mcpServers where
  and
    urlHost exists
    urlHost neq "localhost"
    urlHost neq "127.0.0.1"
    urlHost neq "::1"

Fix

Remove agent credentials from web roots and restrict MCP endpoints.

• Remove web roots containing .claude or .mcp files.
• Reconfigure mcpServers.urlHost to loopback or authenticated. Close remote discovery paths.

Validation

No validation entries recorded.

Grounding

No grounding checks recorded.

References

No references recorded.