Microsoft & Anthropic MCP Servers At Risk of RCE, Cloud Takeovers

Researchers warn that the popular model context protocol (MCP) servers are riddled with security holes, with SSRF risks highlighted for Microsoft’s MarkItDown MCP server and a chain of exploits reported to weaponise Anthropic’s MCP components. On 20 January 2025, Cyata revealed an exploit chain that uses Anthropic’s Git and filesystem MCP servers to achieve remote code execution, while BlueRock disclosed a severe SSRF vulnerability in Microsoft’s MarkItDown.

Across more than 7,000 MCP servers surveyed, around 36.7% may be latent to SSRF exposure, according to BlueRock’s analysis. The Cyata findings describe three medium-severity issues in Anthropic’s official Git MCP server (CVE-2025-68145, CVE-2025-68143, CVE-2025-68144), which when chained with the Filesystem MCP server could enable arbitrary code execution; Anthropic subsequently released the 2025.12.18 Git MCP server update to address these flaws.

Microsoft’s MarkItDown MCP server is noted as one of the most popular, with over 85,000 stars and 5,000 forks on GitHub, and the report says the vulnerability could allow a user to fetch internal or other restricted data if input is not properly restricted. Dark Reading contacted Anthropic for comment but received no response at press time.