Critical MCP Server Flaw Exposes Over 3,000 Servers and Thousands of API Keys

A critical vulnerability in Smithery[.]ai, a Model Context Protocol (MCP) server hosting service, exposed over 3,000 AI servers and thousands of API keys to potential attackers, according to GBHackers. Security researchers found a simple path traversal flaw caused by improper validation of the dockerBuildPath configuration value in the registry’s build process, enabling unauthorized access to sensitive infrastructure files.

By setting the build context to a parent directory and using a malicious Dockerfile, attackers could exfiltrate files, including Docker authentication credentials. The compromised .docker/config.json contained a fly[.]io authentication token with overprivileged access, providing entry to an organisation containing more than 3,000 applications.

The token’s privileges allowed attackers to execute arbitrary code on hosted MCP servers via fly[.]io’s machines API, with researchers showing remote commands could be run with root access on compromised machines. The incident was promptly patched and, according to the article, there was no evidence of active exploitation at the time of disclosure, in a report published on 23 October 2025.