Between 17:20:51.183 and 17:21:03.677 UTC on 27 August, VulnCheck published sixty CVEs. Thirteen of them hit MCP servers and AI agent tooling: CVE-2026-81091 through 81102, plus CVE-2026-81735 against ByteDance's UI-TARS-desktop. The named projects are mcp-use, mark3labs/mcp-go, Apify, mcp-router, Timescale's pg-aiguide, Harvard's ToolUniverse, rails-mcp-server, Telnyx, Timescale's tiger-slack and tiger-gh-mcp-server, Airtable's MCP CLI and Dropbox Dash.
One upstream default explains most of them
The descriptions rhyme. ByteDance's startServer.ts "defaulted its listen address to '::' when no host was given." The mcp-router CLI "served its MCP aggregator on every interface and enforced authentication only when…". pg-aiguide "started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides." mcp-go "accepted requests on its HTTP transports without checking the Host header." This is not thirteen independent mistakes — it is one SDK where DNS-rebinding protection is opt-in, and three of the entries are the same Timescale pattern repeated across sibling repositories.
The scores contradict themselves
Every metric block carries [email protected] on both the primary and secondary CVSS — no vendor score, no NVD score. On six entries the two VulnCheck vectors straddle a severity boundary. ToolUniverse is published as 9.3 CRITICAL and 10.0 CRITICAL for the same bug on the same day. mcp-go, pg-aiguide, tiger-slack and tiger-gh-mcp-server are each 7.6 HIGH and 6.8 MEDIUM simultaneously. Whichever number a downstream scanner ingests is close to arbitrary. None of the thirteen carries a CPE version range.
What the common framing gets wrong
The story reads as a coordinated campaign against MCP. It is not. These thirteen are a sixth of a sixty-CVE bulk backlog flush — twenty-seven of the sixty belong to one unrelated cryptography project, and the batch also sweeps in Ruby's resolv gem, Craft CMS and FrontAccounting. Reading "MCP is under attack" from this is reading a batch-import artefact.
The second correction is timing. Every fix was merged long before disclosure — Apify's between 50 and 161 days earlier, mcp-go's on 8 July. The Apify CVE names a file that pull request #572 deleted as collateral of a dependency cleanup; it has been absent from npm since 0.9.12 in March, and the current release is 0.15.3. Most sharply: the Telnyx "fix" pull request adds the file the CVE names as vulnerable.