Unpatched MetaMCP flaws expose other tenants' tools and the server

What happened

Two CVE records published on 29 September 2026 cover MetaMCP, an open-source aggregator that serves many users' MCP servers from one deployment. CVE-2026-79537 lets an attacker take over another tenant's MCP session with a session ID that an unauthenticated health endpoint discloses, then list and run that tenant's private tools with the victim's forwarded credentials; NVD shows CVSS 3.1 9.1. CVE-2026-79538 is code execution through the MCP inspector proxy's STDIO endpoint, shown by NVD at 9.8.

The researchers' own advisories, published by Traceforce on 22 September, score the pair differently: 8.7 for the session takeover, and 9.9 for the code execution, which they rate as reachable by any signed-in user, with self-registration on by default. Traceforce states that no patched release had been identified as of 22 September, and advises restricting public access and keeping deployments on trusted networks.