CVE-2026-9680 | Improper exposure of the MCP server in alibabacloud-rds-open… | CVSS 5.8 MEDIUM

Description

Improper exposure of the MCP server in alibabacloud-rds-openapi-mcp-server allows remote attackers to invoke exposed MCP tools via network access to an MCP endpoint listening on all network interfaces by default.

Metadata

CVE ID: CVE-2026-9680
State: PUBLISHED
Assigner: alibaba
Reserved: 2026-05-27 09:18 UTC
Published: 2026-07-28 09:05 UTC
Last updated: 2026-07-28 16:08 UTC
Primary CWE: CWE-1188
CWE-1188 Initialization of a resource with an insecure defau…
Vendor / Product: Alibaba / Alibaba Cloud RDS OpenAPI MCP Server
Sources: cve.org · NVD

Severity & Metrics

5.8 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
Alibaba	Alibaba Cloud RDS OpenAPI MCP Server	—	1.8.0 ≤ 3.1.2

Weakness (CWE)

CWE	Source	Description
CWE-1188	cna	CWE-1188 Initialization of a resource with an insecure default

CVSS scores (1)

Score	Severity	Version	Source	Vector
5.8	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

References (1)

https://github.com/aliyun/alibabacloud-rds-openapi-mcp-server