CVE-2026-9680— MCP Server Exposure via Insecure Default Binding on alibabacloud-rds-openapi-mcp-server
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Alibaba | Alibaba Cloud RDS OpenAPI MCP Server | 1.8.0≤ 3.1.2 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-9680
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MCP Server Exposure via Insecure Default Binding on alibabacloud-rds-openapi-mcp-server
Source: CVE Program / CVE List V5
Vulnerability Description
Improper exposure of the MCP server in alibabacloud-rds-openapi-mcp-server allows remote attackers to invoke exposed MCP tools via network access to an MCP endpoint listening on all network interfaces by default.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
不安全的默认资源初始化
Source: CVE Program / CVE List V5
Vulnerability Title
Alibaba Cloud RDS OpenAPI MCP Server 配置错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Alibaba Cloud RDS OpenAPI MCP Server是中国Alibaba公司的一个云数据库API管理服务。 Alibaba Cloud RDS OpenAPI MCP Server 1.8.0版本至3.1.2版本存在配置错误漏洞，该漏洞源于MCP服务器暴露不当，远程攻击者可通过网络访问MCP端点调用暴露的MCP工具。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Alibaba | Alibaba Cloud RDS OpenAPI MCP Server | 1.8.0 ~ 3.1.2 | - |
II. Public POCs for CVE-2026-9680
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-9680
请登录查看更多情报信息。
Other References for CVE-2026-9680 (1)
IV. Related Vulnerabilities
Same weakness: CWE-1188
- CVE-2026-66066
Action Pack: Possible arbitrary file read and remote code ex - CVE-2026-65881
Joomla Extension - joomdle.com - Insecure default configurat - CVE-2026-55708
Privacy/configuration issue when adding local data in views - CVE-2026-62415
Joomla Extension - joomdonation.com - Insecure default confi - CVE-2026-60024
Joomla Extension - joomdonation.com - Insecure default confi
V. Comments for CVE-2026-9680
No comments yet