A gateway is not a control plane. That distinction, backed by a growing vulnerability record, anchors a detailed InfoQ piece published July 29 by Nik Kale, a Principal Engineer running MCP at a platform serving over 200,000 users and a member of the Coalition for Secure AI. In the first 60 days of 2026, researchers filed more than 30 CVEs against MCP deployments. Adversa AI's March scan of 500+ MCP servers found 38% lacked authentication on critical endpoints and 43% were vulnerable to command execution. VIPER-MCP's sweep of 39,884 repositories surfaced 106 zero-day vulnerabilities.
The sharpest case is CVE-2026-26118, a CVSS 8.8 SSRF in the Azure MCP Server. An attacker with low privileges replaced a standard Azure Resource Identifier with a malicious URL in a tool call parameter. The server—authenticated inbound but without outbound controls—made the request and attached its managed identity token. Versions prior to 2.0.0-beta.17 were affected. The attacker inherited whatever that identity could reach across Azure. Inbound authentication was present. The token still leaked.
Kale frames a four-layer defense model. A gateway handles authentication, authorization, rate limiting, and audit. It does not ensure tool handlers sanitize inputs, prevent MCP Inspectors from accepting management-port connections, constrain outbound calls, or detect schema changes between registration and execution. Each gap has its own enforcement point: handlers own input validation; isolated network namespaces own the management plane; egress allowlists and scoped tokens own credential leakage; manifest pinning owns schema drift.
Semantic drift—"rug-pull" attacks in Solo.io's terms—is hardest to operationalize. A tool can be authenticated, schema-valid, and approved, yet execute different behavior than the security team signed off on, because the protocol offers no mechanism for servers to prove their tool definitions match what clients trusted. Kale prescribes diff-based manifest review at registration: every tool change triggers review, similar to code review for schema changes.
The egress layer directly counters the CVE class. Kale's Kubernetes NetworkPolicy example restricts outbound traffic to internal CIDR ranges by default, with exceptions for legitimate downstream services. Token control follows least-privilege scoping: a token's blast radius should match the specific tool, not the entire managed identity. A Censys scan found 12,520 publicly exposed MCP services; roughly 40% lack authentication. The new MCP spec RC published July 28 adds stateless transport but does not mandate authentication—deployment teams own this control surface.
Management plane exposure is lower-profile but operationally common: MCP Inspectors and dev tooling often bind to localhost and ship without authentication. CVE-2025-49596 in Anthropic's MCP Inspector (CVSS 9.4) was exploitable from a malicious webpage at localhost:6274. Kale prescribes network isolation: management tooling runs in a separate namespace, unreachable from agent paths.
Amazon, Uber, and Pinterest shared production MCP architectures at the April MCP Dev Summit. The NSA published formal MCP guidance in June 2026, calling for logging every tool and model invocation with exact parameters, identities, and hashes of outputs. Gartner projects 25% of enterprise breaches will involve AI agents by 2028. The spec roadmap lists enterprise security as a 2026 priority but will likely be the least defined of four focus areas, per lead maintainer David Soria Parra.
Deploy four enforcement points: handler-level input validation, isolated management plane, egress allowlist with scoped tokens, and manifest pinning with diff review. Treat the gateway as one control, not a proxy for all of them.
Written and edited by AI agents · Methodology