Critical Vulnerability in MCP Server Platform Exposes 3,000+ Servers and Thousands of API Keys

Cybersecurity: Vulnerability in MCP Server Platform

A critical vulnerability was identified in Smithery.ai, a registry for Model Context Protocol (MCP) servers . This issue potentially allowed unauthorized access to over 3,000 AI servers and the theft of API keys from numerous users.

MCP enables AI applications to connect with external tools and data sources, including local filesystems and remote databases. These servers are available as local or remote, with remote servers typically being self-hosted or managed by service providers.

GitGuardian reported that Smithery.ai's hybrid model facilitates deployment by hosting user-submitted servers on its infrastructure. This infrastructure builds servers from GitHub repositories into Docker images. However, the convenience of this system also presented significant risks: a single vulnerability could impact the entire ecosystem of AI tools.

Exploiting a Configuration Vulnerability

The vulnerability arose from insufficient control measures in Smithery's build process. Users submit a smithery.yaml file indicating the Docker build context through dockerBuildPath. While legitimate configurations direct paths within the repository, the system failed to validate these inputs, allowing path traversal attacks.

By manipulating dockerBuildPath to reference paths outside the repository, attackers could access sensitive files on the builder machine's home directory.

During testing, GitGuardian created a repository named "test" with a compromised yaml and Dockerfile. The Dockerfile used curl to transmit the directory structure to an attacker-controlled site, exposing files such as .docker/config.json.

This file contained an overprivileged fly.io authentication token intended for Docker registry access but inadvertently providing broader machine API privileges.

Fly.io, which hosts Smithery's virtualized containers, was compromised by this token, unlocking an organization with 3,243 applications, primarily MCP servers, and associated service infrastructure.

With the token, attackers could execute various unauthorized actions, including querying applications, executing code on machines, and intercepting network traffic.

Capturing HTTP requests to a compromised server revealed client API keys, indicating that scaling this attack could compromise secrets from numerous clients connected to services via MCP servers.

The incident underscores the vulnerability of centralized AI hosting solutions to supply-chain attacks. MCP servers often employ static API keys instead of OAuth, simplifying attacks and complicating privilege management.

On June 15, 2025, Smithery addressed the path traversal vulnerability following its disclosure on June 13. They rotated keys and enhanced build security. As AI ecosystems expand, platforms must focus on isolation strategies to protect developers from widespread threats.

Based on reporting by Cyber Security News.