Attack Chain

1. Reconnaissance and Discovery: An attacker scans the internet to identify publicly accessible MCP servers.
2. Unauthenticated Connection: An anonymous client connects to the identified MCP server without requiring any authentication.
3. Tool Catalog Retrieval: The attacker sends a tools/list request, receiving a full, machine-readable catalog of all functionalities (tools) exposed by the server, including their descriptions and parameter schemas.
4. Sensitive Data Access: The attacker invokes tools that proxy sensitive data from backend systems such as production databases, internal mailboxes, issue trackers, and regulated records, leading to the exfiltration of PII, business records, or security findings.
5. Write and Delete Operations: The attacker utilizes tools to create, update, or delete records within critical CRM, IAM, or infrastructure backends, potentially causing data corruption or service disruption.
6. Code Execution and Network Access: The attacker exploits tools designed for direct command execution or leverages embedded language-model agents with shell access to the backend, using carefully crafted prompts to bypass guardrails.
7. Credential Access via SSRF: The attacker directs tools that fetch URLs or proxy requests towards the cloud metadata endpoint, performing Server-Side Request Forgery (SSRF) to obtain temporary cloud credentials.
8. Secret Exposure: The attacker directly retrieves hardcoded credentials or database connection strings that are sometimes embedded within tool responses or retrieved from logs (e.g., Lambda environment variables), leading to further compromise.

Impact

The successful exploitation of unauthenticated MCP servers leads to severe consequences across multiple dimensions. Organizations risk exposure of highly sensitive information, including employee PII, internal business records, and detailed application security findings, which can result in data breaches and regulatory penalties. Attackers can gain the ability to perform unauthorized write and delete operations on critical systems like CRM, IAM platforms, and underlying infrastructure, potentially leading to data manipulation, account compromise, or denial of service. The most severe impact includes remote code execution on backend servers and the theft of cloud credentials, which can grant attackers pervasive access to an organization's cloud environment, facilitating lateral movement, resource manipulation, and large-scale data exfiltration. The report notes that detection is particularly difficult because unauthorized access often appears as legitimate activity due to baked-in credentials and the lack of explicit authentication failures.

Recommendation

• Audit MCP Servers: Conduct a comprehensive audit to identify all Internet-reachable MCP servers and verify their authentication requirements, as described in the Wiz research.
• Implement Authentication: For any public-facing MCP server, enforce authentication for tool execution, even if the tool catalog remains open. Leverage the OAuth 2.1 support introduced in the March 2025 MCP specification where possible.
• Principle of Least Privilege: Limit the permissions of MCP servers and scope their backend credentials to the absolute minimum required for their intended function to prevent anonymous access to sensitive data or destructive actions.
• Enable Agent Logging: For MCP servers wrapping language-model agents, enable and capture agent prompts and invocation logs, as these are critical artifacts for detecting potential code execution or data exfiltration attempts.