CRITICAL MCP SERVER FLAW EXPOSES OVER 3K SERVERS AND THOUSANDS OF API KEYS

Summary from the TLDR InfoSec newsletter

Security researchers discovered a critical path traversal vulnerability in Smithery.ai, a popular MCP server hosting service. The researchers discovered that they could exploit a path traversal vulnerability in the dockerBuildPath configuration value to read files outside of their project. The researchers used this vulnerability to find a fly.io API token that granted root access to more than 3k applications.