Skip to content

MCPwned: Hacking MCP Servers With One Skeleton Key Vulnerability - Jonathan Leitschuh, Independent#

MCP Dev Summit North America 2026 digest Program Wildcard pick 2–3 April 2026

Abstract

Jonathan Leitschuh, Open Source Security Researcher, Independent

  • Why: A genuinely surprising cross-layer attack: the browser's same-origin model meets the new local agent-port surface. It's the one talk here where the exploitation primitive is classic network-level technique applied to AI infrastructure.
  • What: Weaponizes a widely overlooked MCP-spec weakness — browser-based DNS rebinding — against SSE and streaming-HTTP MCP servers to exfiltrate data and escalate access; visiting a malicious website can compromise a locally running MCP server (from abstract only).
  • How: DNS rebinding defeats same-origin protections to let attacker pages talk to localhost MCP servers over SSE/streaming HTTP, then abuse the server's access to data and credentials.
  • Where applicable: Any locally running HTTP/SSE MCP server (the Cursor/Claude Desktop deployment pattern). Drives home why the proxy and transport-hardening patterns in the core talks are not optional.