Wiz Finds Internet-Exposed MCP Servers Leaking Sensitive Data and Cloud Credentials
Summary
Wiz Research found unauthenticated Internet-exposed MCP servers at organizations including Fortune 500 companies, with some exposing sensitive data, destructive tools, code execution, or temporary cloud credentials.
Key points
- MCP servers appeared in 80% of cloud environments studied; about one in six environments exposed at least one server.
- About 70% of exposed servers disclosed their tool catalogs to anonymous callers, 42% returned real data when tools were called, and 10% exposed a sensitive backend.
- Researchers found access to sensitive records, internal systems, and credentials, as well as tools capable of modifying or deleting records.
- A small confirmed number of servers allowed server-side requests to cloud metadata endpoints and returned temporary credentials.
- Nearly all observed servers used the original 2024-11-05 protocol version, predating the March 2025 addition of authentication to the specification.
- Wiz recommends auditing Internet exposure, requiring authentication for tool execution, capturing agent prompts and invocation logs, and limiting backend credentials to the minimum necessary.
Article Details
- Attack Vectors
- Internet-reachable MCP servers without authentication expose tool catalogs and, in some cases, sensitive data or write and delete operations through backend credentials stored in the deployment.
- Some exposed tools can execute commands or evaluate code on the server, including through language-model agents with shell access.
- Tools that fetch URLs or proxy requests can be used for server-side request forgery to reach internal services and cloud instance metadata; the research confirmed temporary credentials were returned by the metadata service on a small number of hosts.
- Some tools directly disclose secrets, including API keys in Lambda function logs and database connection strings with embedded credentials.
- Defensive Notes
- Audit Internet-reachable MCP servers and determine whether they require authentication.
- Gate tool execution behind authentication, using OAuth 2.1 where possible; otherwise restrict server permissions to prevent anonymous access to sensitive data or destructive actions.
- Capture agent prompts and enable invocation logs, particularly for servers capable of code execution.
- Apply least privilege and scope MCP server backend credentials to the minimum required.
MITRE ATT&CK
Products
AWS“Show me the AWS credentials” - refused.CloudWatchLambdaIn one case, Lambda function logs retrieved through cloudwatch_get_lambda_logs contained environment variables with API keys.Model Context ProtocolModel Context Protocol has been rapidly gaining popularity ever since its debut, but adoption of its security features hasn't caught up.