[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZqXftqVixjK-DO1Zq3YOL_uiOCfFr7wIGrCV6OOF7c8":3},{"article":4,"iocs":50,"watch_terms":51,"solutions":52,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"ccc858ff-902b-4d67-8aa9-b21ae7f2f4f5","Hackers Could Exploit MCP Server Supply Chain Weaknesses to Steal API Keys and Administrator Credentials","hackers-could-exploit-mcp-server-supply-chain-weaknesses-to-steal-api-keys-and-a-3c8a6b","Security teams that run AI coding assistants may be exposing their most powerful credentials without knowing it. A new study shows that Model Context Protocol (MCP) servers can quietly change their own code after they are set up. If an attacker poisons just one package in that chain, they could steal API keys and administrator […] The post Hackers Could Exploit MCP Server Supply Chain Weaknesses to Steal API Keys and Administrator Credentials appeared first on Cyber Security News.","A new study by Corelight reveals that Model Context Protocol (MCP) servers, used by AI coding assistants, can be vulnerable to supply chain attacks. Attackers can poison packages within the server's dependency chain, allowing them to steal API keys and administrator credentials. This occurs because the setup process for these servers often fetches dependencies dynamically, leading to unpredictable version changes and potential inclusion of malicious code.","MCP servers used by AI coding assistants can be exploited via supply chain attacks to steal credentials.","https:\u002F\u002Fcybersecuritynews.com\u002Fhackers-could-exploit-mcp-server\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FHackers-Could-Exploit-MCP-Server-Supply-Chain-Weaknesses-to-Steal-API-Keys-and-Administrator-Credentials.webp","2026-11-11T16:07:18+00:00","2026-11-11T17:00:34.618376+00:00",8,[17,20,23,25],{"name":18,"type":19},"Model Context Protocol (MCP)","technology",{"name":21,"type":22},"Corelight","vendor",{"name":24,"type":19},"Python Package Index (PyPI)",{"name":26,"type":19},"npm","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":27,"icon":29,"name":30,"slug":31},null,"Supply Chain","supply-chain",[33,38,40,45],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":39},{"id":27,"icon":29,"name":30,"slug":31},{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":46},{"id":47,"icon":29,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21],{"controls":53,"vendors":133},[54,82,111],{"slug":55,"name":56,"problem":57,"products":58},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[59,67,74],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":55,"product_name":71,"url":72,"description":73},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"slug":83,"name":84,"problem":85,"products":86},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[87,95,103],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"slug":112,"name":113,"problem":114,"products":115},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[116,124,125],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",[134],{"slug":135,"name":21,"logo_path":136,"roles":137},"corelight","\u002Fvendor-logos\u002Fcorelight.png",[138],"reported_by",{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":149},"ai-coding-assistant-mcp-servers-expose-api-keys-via-poisoned-dependencies","AI Coding Assistant MCP Servers Expose API Keys via Poisoned Dependencies","MCP servers used by AI coding assistants dynamically fetch dependencies at setup time, creating an exploitable window where attackers can substitute or poison packages in the dependency chain to steal API keys and administrator credentials. This is a classic supply chain attack vector amplified by the AI tooling ecosystem's rapid growth and often immature security practices. The lack of dependency pinning, integrity verification, and runtime monitoring means malicious code can silently execute with the same privileges as the legitimate server. This matters because API keys and admin credentials harvested this way can enable full compromise of cloud environments, source code repositories, and downstream systems.",[144,145,146,147,148],"MITRE ATT&CK T1195.001: Supply Chain Compromise: Compromise Software Dependencies and Development Tools","NIS2 Article 21(2)(d)","CIS Control 16: Application Software Security (v8)","NIST SP 800-53 SA-12: Supply Chain Protection","OWASP A06:2021 Vulnerable and Outdated Components",{"NIS2 Article 21(2)(d)":150,"NIST SP 800-53 SA-12: Supply Chain Protection":151,"OWASP A06:2021 Vulnerable and Outdated Components":152,"CIS Control 16: Application Software Security (v8)":153,"MITRE ATT&CK T1195.001: Supply Chain Compromise: Compromise Software Dependencies and Development Tools":154},"NIS2 Article 21(2)(d) requires organisations to manage security risks in their supply chains, including the software dependencies they consume, which would have mandated controls over MCP server package sourcing.","SA-12 requires organisations to protect against supply chain threats by applying controls to the acquisition and use of software components, which would have covered the dependency fetching risk in MCP servers.","This category directly addresses the risk of using unverified or dynamically resolved third-party components that may introduce malicious or vulnerable code, as occurred with the MCP server dependency chain.","CIS Control 16 requires secure software development and third-party component management practices, including inventory and vetting of open-source dependencies that MCP servers pull dynamically.","This technique specifically covers attackers poisoning software dependencies to inject malicious code, which is exactly the attack vector used against MCP server package chains."]