CVE-2026-9680

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2026
Source publication: Jul 28, 2026
Source updated: Jul 28, 2026
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

MCP Server Exposure via Insecure Default Binding on alibabacloud-rds-openapi-mcp-server

Improper exposure of the MCP server in alibabacloud-rds-openapi-mcp-server allows remote attackers to invoke exposed MCP tools via network access to an MCP endpoint listening on all network interfaces by default.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

Alibaba Cloud RDS OpenAPI MCP Server

Vendor: Alibaba
Product: Alibaba Cloud RDS OpenAPI MCP Server
Platforms: Unknown
Default status: unaffected

Alibaba Cloud RDS OpenAPI MCP Server · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1.8.0	`affected`	custom	Unavailable	3.1.2	None listed