From Path Traversal to Supply Chain Compromise: Breaking MCP Server Hosting
· Source: gitguardian.com
In short
A vulnerability in Smithery.ai's popular MCP server hosting service was discovered, exposing over 3,000 hosted AI servers and thousands of customers' credentials due to a configuration bug. Attackers could execute arbitrary code and steal API keys, raising significant supply chain risks. The vulnerability was responsibly disclosed and promptly patched.
Read Original Article — Read the full article on the publisher’s site.
In the issue of week 42, 2025: AI-Driven Last-Mile and Agentic Workflows Unlock $100M+ Supply Chain Value
Tags: security, supply chain, MCP, vulnerability, credentials, hosting