Critical MCP Server Flaw Exposes Over 3,000 Servers and Thousands of API Keys

A critical vulnerability in Smithery.ai, a widely used Model Context Protocol (MCP) server hosting service, exposed over 3,000 AI servers and numerous API keys to potential security threats.

Security researchers identified a path traversal flaw that permitted unauthorized access to sensitive infrastructure files, compromising administrative credentials and potentially affecting entire AI ecosystems. The vulnerability was located in the dockerBuildPath configuration during the registry's build process, allowing attackers to access files outside the MCP server code repository.

Researchers demonstrated the flaw by exploiting the build context setting to access parent directories and retrieve sensitive files, including Docker authentication credentials. The compromised .docker/config.json file contained a fly.io authentication token with excessive permissions, enabling unauthorized access to an organization hosting over 3,000 applications, primarily MCP servers.

The elevated privileges associated with the stolen token allowed for arbitrary code execution on hosted servers via the fly.io machines API. Researchers successfully executed remote commands with root access, showcasing the severity of the vulnerability.

This breach posed a considerable supply chain risk, as MCP servers manage authentication secrets for external resources. Control over these servers allowed attackers to intercept network traffic and capture API keys from client requests, affecting thousands of customers across various services.

Security Implications and Recommendations

The vulnerability was responsibly disclosed and promptly patched, with no evidence of active exploitation. However, this incident underscores the security challenges inherent in centralized AI infrastructure. MCP servers facilitate connections between AI applications and external tools, but their concentration creates high-value targets susceptible to significant risks from single vulnerabilities.

Security experts recommend careful evaluation of MCP hosting models and the implementation of robust secrets management practices. Despite its limitations, OAuth authentication, when correctly configured, can mitigate the impact of supply chain compromises.

With the ongoing evolution of AI infrastructure, the centralization of sensitive credentials necessitates heightened security measures and adherence to best practices for credential handling and authentication within MCP environments.

Based on reporting by GBHackers.