CVE-2026-9680 — MCP Server Exposure via Insecure Default Binding on alibabacloud-rds-openapi-mcp-server

CVE-2026-9680

MCP Server Exposure via Insecure Default Binding on alibabacloud-rds-openapi-mcp-server PUBLISHED

Description (CNA)

Improper exposure of the MCP server in alibabacloud-rds-openapi-mcp-server allows remote attackers to invoke exposed MCP tools via network access to an MCP endpoint listening on all network interfaces by default.

Affected (CNA)

Vendor / product	Versions
Alibaba / Alibaba Cloud RDS OpenAPI MCP Server	affected 1.8.0 through 3.1.2

CWE

CWE-1188

References

https://github.com/aliyun/alibabacloud-rds-openapi-mcp-server

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.