Unauthenticated MCP Server Exposed AWS Credentials Through SSRF and File Inclusion
Summary
CloudSEK says an unauthenticated MCP server exposed a customer’s internal tools, allowing an audio proxy to access AWS metadata and read local files, exposing IAM credentials and database secrets.
Key points
- CloudSEK reported finding a publicly reachable MCP server in an anonymized customer environment that required no authentication.
- The server exposed internal tools, including an audio proxy that accepted arbitrary URLs without validation.
- The proxy enabled SSRF to the AWS Instance Metadata Service, returning live IAM credentials.
- Accepting file:// URLs also allowed local file reads, including environment variables containing plaintext database credentials.
- The exposed tools and credentials created risks including cloud-resource access, database compromise, customer-data exposure, and abuse of telephony services.
- CloudSEK recommends securing all MCP endpoints, restricting proxy destinations and URL schemes, requiring IMDSv2, and rotating exposed credentials.
Article Details
- Victim Organization
- Not disclosed
- Victim Domain
- Not disclosed
- Incident Type
- Unauthenticated MCP server exposure exploited through SSRF to AWS IMDS and local file inclusion, exposing live AWS IAM credentials and database credentials.
- Data Types Exposed
- AWS IAM credentials
- Database credentials
- Phone numbers
- Call records
- Message metadata
- Affected Records
- Unknown
- Affected Data Size
- Unknown
- Operational Impact
- The source reports successful retrieval of live AWS IAM credentials and plaintext database credentials, and exposure of customer phone numbers, call records, and message metadata. Broader AWS compromise, database access, remote code execution, and abuse of telephony tools are described as potential impacts, not confirmed outcomes.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
CVE
CVE-2025-51591tracked an active SSRF-to-IMDS campaign targeting EC2-hosted applications throughout March 2025 [9]. CVE-2025-51591 is a dedicated SSRF-to-IMDS CVE that explicitly identifies this as a critical cloud attack vectorCVE-2025-54136malicious MCP server, September 2025), and MCPoison persistent code execution in Cursor IDE (CVE-2025-54136). MCP is no longer experimental infrastructure. It is the connective tissue of enterprise AI, and itCVE-2025-68143(downloaded nearly half a million times), the Anthropic mcp-server-git three-CVE RCE chain (CVE-2025-68143, CVE-2025-68144, CVE-2025-68145), the postmark-mcp npm package backdoor (the first confirmedCVE-2025-68144nearly half a million times), the Anthropic mcp-server-git three-CVE RCE chain (CVE-2025-68143, CVE-2025-68144, CVE-2025-68145), the postmark-mcp npm package backdoor (the first confirmed in-the-wild maliciousCVE-2025-68145a million times), the Anthropic mcp-server-git three-CVE RCE chain (CVE-2025-68143, CVE-2025-68144, CVE-2025-68145), the postmark-mcp npm package backdoor (the first confirmed in-the-wild malicious MCP server,CVE-2026-33626CVE that explicitly identifies this as a critical cloud attack vector [10]. Most recently, CVE-2026-33626 in LMDeploy’s AI inference module demonstrated the identical pattern, with in-the-wild exploitation
Threat Actors
Malware
Vendors
Amazon Web ServicesMCP server with exposed internal tools that chained into SSRF, LFI, and the exfiltration of live AWS IAM credentials and database secrets. All details identifying the customer, their assets, and associatedAnthropicThe Model Context Protocol (MCP), introduced by Anthropic in November 2024, provides a standardized interface for AI assistants to interact with external tools, data sources, and APIs. It is now the de facto integrationCloudSEKfinding described in this case study is a real-world instance of this attack pattern, discovered through CloudSEK AIVigil’s continuous AI attack surface monitoring across our customer dataset. All identifying details
Products
AIVigilin this case study is a real-world instance of this attack pattern, discovered through CloudSEK AIVigil’s continuous AI attack surface monitoring across our customer dataset. All identifying details have beenClaude CodeConfirmed by Anthropic as the first AI-orchestrated cyber espionage campaign at scale. Used Claude Code connected via MCP to chain open-source penetration testing tools (Nmap, Metasploit) into a fully autonomousCloudSEK Nexus AIand assessment tooling. AIVigil identifies AI-layer initial access vectors and feeds them into CloudSEK Nexus AI, which correlates them with external threat signals, dark web activity, and third-party ecosystemMCPBackground: MCP and the Expanding AI Attack SurfaceMCP Marketactors created a network of trojanized MCP servers submitted to legitimate MCP registries including MCP Market. Servers were disguised as legitimate integrations to deploy StealC infostealer via SmartLoader.Slackto execute arbitrary code with user privileges, exfiltrate local credentials and files including Slack message histories, and install persistence mechanisms silently. Used custom tool MCPHammer to validateSpring BootThe MCP server was deployed as part of a Spring Boot application integrating AI-driven voice and messaging capabilities into a customer-facing communications platform. The exposed toolset reveals the underlying AI
Tools
MCPHammerPraetorian red team (MCPHammer)Metasploit Frameworkat scale. Used Claude Code connected via MCP to chain open-source penetration testing tools (Nmap, Metasploit) into a fully autonomous intrusion framework. AI handled 80-90% of tactical operations: reconnaissance,Nmapcampaign at scale. Used Claude Code connected via MCP to chain open-source penetration testing tools (Nmap, Metasploit) into a fully autonomous intrusion framework. AI handled 80-90% of tactical operations:
Countries
ChinaIntelligence Group (GTIG) confirmed in early 2026 that adversaries, including nation-state actors from China, Iran, and North Korea, have operationalized LLMs and MCP infrastructure as force multipliers forIranGroup (GTIG) confirmed in early 2026 that adversaries, including nation-state actors from China, Iran, and North Korea, have operationalized LLMs and MCP infrastructure as force multipliers forNorth Korea(GTIG) confirmed in early 2026 that adversaries, including nation-state actors from China, Iran, and North Korea, have operationalized LLMs and MCP infrastructure as force multipliers for reconnaissance, initial
Industries
Chemicalsbinding the AI to its toolset. Targeted approximately 30 organizations across technology, finance, chemicals, and government.financelayer binding the AI to its toolset. Targeted approximately 30 organizations across technology, finance, chemicals, and government.GovernmentAI to its toolset. Targeted approximately 30 organizations across technology, finance, chemicals, and government.Technologythe orchestration layer binding the AI to its toolset. Targeted approximately 30 organizations across technology, finance, chemicals, and government.