MCP was supposed to connect your AI tools to your infrastructure. Instead it just handed attackers the keys. April's disclosures reveal a protocol that shipped capability without controls, and the exploitation has already started.
After 33 years in this industry, I have watched the same pattern repeat: a new protocol gains adoption faster than it gains security controls, and the gap between those two curves is where adversaries set up shop. The Model Context Protocol is the latest entry in a very old ledger.
The nginx-ui MCP Authentication Bypass
CVE-2026-33032 (CVSS 9.8) is the kind of vulnerability that makes you question what "code review" even means anymore. Pluto Security discovered that when nginx-ui added MCP support, it split communication across two HTTP endpoints. The connection endpoint `/mcp` carried authentication middleware. The message endpoint `/mcp_message`, which processes every tool invocation including configuration writes and server restarts, did not.
One missing function call. Twelve MCP tools exposed to unauthenticated callers. Seven of them destructive: inject nginx configurations, reload the server, intercept all traffic passing through it. The remaining five give attackers reconnaissance, reading existing configs and mapping backend infrastructure.
Over 2,600 publicly reachable nginx-ui instances were identified on Shodan across Alibaba Cloud, Oracle and Tencent. The Docker image has been pulled more than 430,000 times. The patch in version 2.3.4 amounted to 27 characters of added code.
Twenty-seven characters. That is the distance between a secure deployment and complete server takeover.
This is the second MCP vulnerability Pluto Security has disclosed recently, following MCPwnfluence, an SSRF-to-RCE chain in the Atlassian MCP server. Both cases reveal the same structural problem: when MCP connects to an existing application, its endpoints inherit the full capabilities of that application without inheriting any of the security controls.
Hundreds of MCP Servers Already Exposed
Backslash Security analysed more than 7,000 MCP servers accessible on the public web. Hundreds are vulnerable to a misconfiguration they call "NeighborJack," exposed to anyone on the same local network. Around 70 have severe flaws including unchecked input handling and excessive permissions. In several cases both issues are present, meaning complete host takeover.
Over 15,000 MCP servers are now in use worldwide. The adoption curve has outpaced the security curve by a considerable margin. As James Sherlow at Cequence Security put it: "MCPs are proxies and can inadvertently obfuscate the client side actor." When you cannot tell whether a request came from a human or an AI agent, your access controls are theatre.
AI Agent Data Leaks in Microsoft Copilot and Salesforce Agentforce
It is not just MCP infrastructure at risk. The AI agents themselves have problems. Dark Reading reported this month that prompt injection flaws in Salesforce Agentforce and Microsoft Copilot would have allowed an external attacker to leak sensitive data. Two of the most widely deployed enterprise AI tools, and the attack vector was the same one we have been warning about since ChatGPT launched: manipulate the prompt, extract the data.
Prompt injection is not a theoretical risk. It is the SQL injection of the AI era. And like SQL injection, it keeps appearing because developers treat LLM inputs as data rather than executable instructions.
ATHR: Voice Phishing as a Service
For $4,000 and 10% of the take, a lone criminal can now run a fully automated voice phishing operation. Abnormal AI researchers documented ATHR, a platform that spoofs email alerts from Google, Microsoft and Coinbase, buries a phone number in each message, and when the victim calls back, routes them to either a human scammer or an AI voice agent running on a custom text-to-speech engine.
The AI agents handle live calls autonomously. Each follows a structured script: verify the callback, describe suspicious account activity, confirm an unrecognized phone number, initiate a fake recovery process, extract the six-digit verification code. The operator can monitor active calls from a single dashboard and adjust lures in real time based on success rates.
Earlier callback phishing platforms still depended on human callers. ATHR removes that bottleneck entirely. The operator never leaves the browser. This is industrialisation of social engineering, and it works because the AI agent on the other end of the phone sounds convincing enough to keep the victim engaged through the entire credential extraction sequence.
CISA KEV Updates: Three Cisco Flaws and a SharePoint Zero-Day
CISA added eight new vulnerabilities to its Known Exploited Vulnerabilities catalog that week, including three Cisco Catalyst SD-WAN Manager flaws (CVE-2026-20122, CVE-2026-20128, CVE-2026-20133) covering incorrect use of privileged APIs, passwords stored in recoverable format, and sensitive information exposure. When your SD-WAN management platform has three separate actively exploited vulnerabilities in a single KEV update, that is not a patching problem. That is a vendor problem.
Also added: PaperCut NG/MF (CVE-2023-27351), JetBrains TeamCity (CVE-2024-27199), Kentico Xperience (CVE-2025-2749), Quest KACE SMA (CVE-2025-32975), and Zimbra (CVE-2025-48700). Some of these CVEs are years old. If you still have not patched PaperCut, I cannot help you.
Meanwhile, Microsoft's April Patch Tuesday addressed a record 169 security flaws including CVE-2026-32201, a SharePoint Server spoofing vulnerability (CVSS 6.5) already being exploited in the wild. CISA has given federal agencies until 28 April to remediate. A privilege escalation flaw in Microsoft Defender (CVE-2026-33825, CVSS 7.8) was also flagged as publicly known at release.
n8n Webhooks Weaponised for Phishing
Threat actors have been abusing n8n, a popular AI workflow automation platform, since October 2025 to deliver malware via phishing emails. By leveraging trusted infrastructure, the campaigns bypass traditional email security controls. When the automation tool becomes the attack vector, the boundary between productivity and risk disappears entirely.
The Pattern
Three MCP vulnerabilities in quick succession. Hundreds of misconfigured MCP servers on the public internet. Prompt injection in the two most widely deployed enterprise AI agents. Voice phishing automated to the point that one person can run what used to require a call centre. Workflow automation tools repurposed as phishing infrastructure.
The thread connecting all of it: capability is being deployed faster than the controls to govern it. MCP gives AI agents full access to your infrastructure with no standardised authentication framework. AI agents handle sensitive data with input validation that would get a web application failed in a penetration test. Voice AI is convincing enough to trick humans but there is no caller ID for robots.
This is not a technology problem. It is a governance problem. And the governance is nowhere near keeping up.
,-
Jonathan Care has 33 years in cybersecurity and fraud detection. These are his personal views, not those of his employer.