Corelight: dependency drift lets 'pinned' MCP servers used by AI coding assistants run unreviewed code with privileged access
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 13/11/2026 12:06; os links antigos trazem para cá.
Fontes: helpnetsecurity.com ↗ gbhackers.com ↗
Corelight research published in mid-November 2026 shows that MCP (Model Context Protocol) servers managed by AI coding assistants can silently change their dependencies between rebuilds, even when configured to run a fixed release. The servers often hold user credentials and inherit elevated privileges, so unreviewed code in the dependency tree is a supply chain risk. Researcher James Lagermann (Corelight's Director of Technical Alliances) found that on one workstation 23 of 69 packages changed versions over several weeks, including critical libraries such as cryptography and JSON Web Token (helpnetsecurity.com). Corelight audited 35 MCP servers and found that 23 of their recommended installs regularly pull fresh dependencies from public registries (helpnetsecurity.com). It notified the affected maintainers, and at least one vendor has since repackaged its server and updated its security review process (helpnetsecurity.com). Corelight's mitigation is to freeze the environment, pin dependencies to commits and hashes, and limit privileges.
Entenda a falha
A vulnerabilidade
The story lists CVE-2024-3094, but the gbhackers article cites that ID only for the xz Utils backdoor, as an example of a poisoned release. It gives no CVE for the mcp-remote flaw, so the story's link is unverified. The flaw is a command injection rated CVSS 9.6 in the mcp-remote proxy, affecting 0.0.5 to 0.1.15 and fixed in 0.1.16. The articles do not say what an attacker needs or gets beyond command injection. The main subject is a wider weakness: MCP servers started by AI assistants through uvx or npm runners pull changing dependencies even when pinned to a release, and they often hold the user's credentials. Corelight says this is a setup choice, not an MCP flaw.
Como funciona
The articles do not explain how the mcp-remote injection works. They do describe the drift. An AI assistant starts an MCP server at each session with uvx, or with an npm proxy tagged latest. Each entry names an exact release tag, PyPI version or Git commit. When the launcher rebuilds the environment, it resolves the underlying dependencies fresh from the public registry. Every package loads into the server process and inherits its access, such as API tokens, user files and network paths. A malicious release live for only minutes or hours could be pulled and run with no one issuing an install command, while the server's own version number stays the same.
Por que é vulnerável
Pinning a package version does not pin the packages it depends on. In the studied community server, the maintainer pinned seven direct dependencies and published a hash-pinned lock file, but uvx installed from the declared dependencies and skipped the lock file. About 60 transitive packages were therefore resolved fresh on every rebuild. Of 35 MCP servers reviewed, 23 recommended an install that pulls from a public registry. The articles give no root cause for the mcp-remote command injection beyond its fix in 0.1.16.
Como foi descoberta
James Lagermann, Corelight's Director of Technical Alliances, found the drift in the company's lab. The investigation began as a blast-radius analysis using an AI agent, which noticed other AI agents on an administrator's workstation; nothing was compromised. Zeek DNS and TLS evidence plus EDR telemetry showed the registry connections, and over five weeks one release ran in 15 distinct environments. Lagermann told Help Net Security he notified the maintainers and services behind 23 public servers; one AI agent exchange host updated its security review, and one vendor is repackaging its server. The articles do not say who found the mcp-remote flaw or how it was reported.
Explicação gerada por IA a partir da matéria e dos artigos, em 13/11/2026 12:21.
Detalhes técnicos
- MCP servers launched through AI assistants resolve dependencies dynamically from PyPI and npm, often without hash pinning. Rebuilds happen automatically and frequently pull fresh dependencies, which widens the attack surface (gbhackers.com).
- The root cause for Python servers is that the uvx launcher does not respect pinned lock files. It resolves dependencies afresh on every rebuild, so servers run with different dependency sets over weeks without any configuration change (helpnetsecurity.com).
- Unintended updates can introduce malware or vulnerabilities even though the MCP server's own version never changes (helpnetsecurity.com).
- Corelight cited the June 2026 Shai-Hulud worm variant attack on PyPI, which targeted MCP packages, as an example of this exposure (helpnetsecurity.com).
- The mcp-remote proxy has a command injection flaw rated CVSS 9.6. It affects versions 0.0.5–0.1.15 and is fixed in 0.1.16. The identifier given for it is CVE-2024-3094 (gbhackers.com). That is the only source for this CVE ID, and it does not appear in the other source (see Conflicting Reports).
Remediação
- Freeze MCP server environments. Pin dependencies to specific commits, use hash-pinned lock files, launch servers directly, and disable update checks or automatic dependency updates (gbhackers.com, helpnetsecurity.com).
- Corelight's tests showed this gives a consistent package set, at the cost of dependencies that age. It advises nightly vulnerability reviews, plus periodic re-locking and re-validation of package versions (helpnetsecurity.com, gbhackers.com).
- Limit server privileges and network scope, use scoped read-only credentials, and enforce policies for environment permissioning and rebuilds (gbhackers.com).
- Upgrade mcp-remote to 0.1.16 or later (gbhackers.com).
Relatos divergentes
- CVE attribution: gbhackers.com ties the mcp-remote CVSS 9.6 flaw to CVE-2024-3094. helpnetsecurity.com, the later source, does not mention this CVE or flaw. The identifier is unverified, so defenders should confirm it against the vendor or advisory record before relying on it.
- Scope of the drift problem: gbhackers.com frames it as AI-managed servers resolving dependencies dynamically from PyPI and npm. helpnetsecurity.com, the later source and the one with more specific figures, describes drift in servers configured to a pinned release and attributes it to uvx ignoring lock files.
Linha do tempo
-
Corelight research reveals dependency drift risk in pinned MCP servers impacting AI coding assistants
ler a análise desta fonte ocultar
Corelight's Director of Technical Alliances, James Lagermann, discovered that MCP (Model Context Protocol) servers configured to run a fixed release can still experience significant dependency drift, running with multiple different sets of dependencies over weeks without configuration changes. MCP servers, which AI coding assistants use to interact with other tools and often hold user credentials, were found to have twenty-three out of sixty-nine packages change versions on a workstation, including critical libraries like cryptography and JSON Web Token. This behavior is due to their Python package launcher (uvx) not respecting pinned lock files, leading to fresh dependency resolution on every rebuild and frequent environment changes. Corelight audited 35 MCP servers and found 23 recommended installs pull fresh dependencies from public registries regularly, exposing them to risks like the June 2026 Shai-Hulud worm variant attack on PyPI targeting MCP packages. To mitigate this, Corelight tested freezing MCP server environments by pinning to commits and disabling updates, ensuring consistent package sets at the cost of aging dependencies, with nightly vulnerability reviews advised. Corelight notified affected maintainers, prompting updated security review processes and repackaging by at least one vendor. This issue represents a supply chain risk in AI assistant infrastructures, as unintended dependency updates can introduce malware or vulnerabilities without version changes in the servers themselves.
-
Corelight Warns AI Agents Can Silently Run Unreviewed Code With Privileged Access to Enterprise Networks
ler a análise desta fonte ocultar
Corelight’s investigation highlights significant security risks associated with AI coding assistants managing MCP servers in enterprise environments. The lab revealed that these AI-managed servers frequently change dependencies without explicit configuration changes, inheriting elevated privileges and exposing critical credentials. Rebuilds occur automatically, often with fresh dependencies, increasing the attack surface. Notable issues include a CVSS 9.6 command injection vulnerability in the mcp-remote proxy and the potential for malicious code execution via dependency drift, especially in AI-driven, automated environments. Corelight recommends environment freezing, strict pinning, and scope limitations to mitigate risks.
Technical Details
The investigation centered on MCP servers launched through AI assistants that resolve dependencies dynamically from PyPI and npm, often without pinning hashes. Over several weeks, environments varied significantly, with multiple package version changes. A CVSS 9.6 vulnerability (CVE-2024-3094) affecting versions 0.0.5–0.1.15 of the mcp-remote proxy was identified and fixed in 0.1.16. Attackers can exploit this to achieve command injection.
Fix Details
In response, Corelight recommends pinning dependencies to specific commits, using hash-pinned lock files, launching servers directly, and disabling update checks. These measures stabilize the environment, reduce drift, and lower attack risks. Monitoring and re-locking package versions periodically, along with scoped read-only credentials, are essential to maintaining security.
Remediation
Implement strict dependency management by pinning versions to specific commits and hashes, freeze environments, and disable automatic dependency updates. Limit server privileges and scope network access. Regularly review and re-validate environment integrity, and enforce operational policies for environment permissioning and rebuilds.