Quirin Schlegel

Loading

The courier, not the victim - a Context7 MCP flaw meets the CRA reporting clock

Upstash's Context7 - the MCP server that feeds up-to-date library documentation to AI coding agents - carries CVE-2026-75130, disclosed 18 August 2026: poisoned Custom AI Instructions can make a connected agent, during a routine docs request, exfiltrate .env credentials and delete files on the developer's machine. The same analyst rates it 9.0 Critical (CVSS 3.1) and 6.4 Medium (CVSS 4.0) because the 4.0 vector scores the server's own confidentiality, integrity and availability as None while the developer machine downstream scores High - the server is the courier, not the victim. No fixed version is named; the same feature was hit and patched in February. The EU consequence is the Cyber Resilience Act: an MCP server is a product with digital elements, and Article 14's reporting duty starts 11 September 2026, putting a 24-hour clock on the manufacturer of any component whose vulnerability is being exploited.

24 August 20267 verified claims5 sources

Your coding agent asks Context7 for a library's docs fifty times a day. Last week's disclosure showed that same request can carry someone else's instructions back to your machine.

CVE-2026-75130, published 18 August, sits in Upstash's Context7 — the MCP server that feeds up-to-date library docs to AI coding agents. Poison its Custom AI Instructions and, on a routine docs lookup, the agent can be told to read your .env, ship the keys to an attacker-controlled service, and delete files on your machine.

Now the part worth slowing down for.

The same analyst scored it twice: 9.0 Critical under CVSS 3.1, 6.4 Medium under CVSS 4.0. Not a disagreement — two scales. The newer one is the more honest, rating Context7's own confidentiality, integrity and availability as none. The server is not the victim. It is the courier. The impact lands downstream — on your laptop and the agent that trusted it.

The same feature was hit in February by the same researcher and patched in days. The August CVE lists no fixed version; the package has since moved to 4.0.x, and no advisory confirms the current release is clear.

Now the European part.

An MCP server is software marketed under a maker's name. Under the Cyber Resilience Act — Regulation (EU) 2024/2847 — that makes it a product with digital elements. Article 14's reporting duty starts 11 September, eighteen days out. Learn that a vulnerability in your product is being exploited, and you owe an early warning within 24 hours, a notification within 72, and a final report within 14 days of a fix — to a national CSIRT and ENISA.

The reasonable reading is that this is Upstash's bug to fix — except the impact never touches Upstash, and once exploited, the reporting clock is the maker's, not the user's.

What I'd do Monday:

1. Inventory your MCP servers as dependencies. Pin versions. "Latest" is not a supply-chain policy. 2. Run agents with no ambient credentials in reach. The exfiltration path is reading env vars. 3. Treat every MCP tool response as untrusted input. 4. Shipping an agent product in the EU? Map that supply chain now — an exploited flaw in a component is a 24-hour clock.

Which of your agent's dependencies could read your .env — and would you know within a day if one was being used against you?

#AIregulation #CyberResilienceAct #AgenticAI #MCP #AIcodingAgents

Evidence

What this rests on

Every factual claim in the edition above, stated on its own and checked before publication. If one of these is wrong, the argument is wrong — so they are listed where you can check them.

CVE-2026-75130 (NVD, published 18 August 2026, CNA VulnCheck) is a prompt-injection vulnerability in Upstash's Context7, affecting versions 0 through 2.1.2 and classified CWE-1427; the injection is delivered through the Custom AI Instructions feature served via the Context7 MCP server.
Why it mattersThe affected component is not the agent but a documentation MCP server the agent trusts by default - the dependency, not the model, is the attack surface.
nvdnistnati2026cve · vulncheck2026context
The same CNA scored CVE-2026-75130 at 9.0 Critical under CVSS 3.1 and 6.4 Medium under CVSS 4.0; the CVSS 4.0 vector rates the vulnerable system's own confidentiality, integrity and availability as None (VC:N/VI:N/VA:N) while scoring the subsequent system High (SC:H/SI:H/SA:H).
Why it mattersThe split score is the point: the MCP server carries the injection but takes no damage itself, so a severity read that stops at the server misjudges the risk to the developer machine downstream.
nvdnistnati2026cve · vulncheck2026context
Per the VulnCheck advisory, an attacker who poisons Context7's Custom AI Instructions can cause a connected agent, during a routine library-documentation request, to exfiltrate credentials from environment files to an attacker-controlled service and to perform destructive file deletion on the victim's machine.
Why it mattersThe trigger is an ordinary, unattended action - asking the agent for current docs - so there is no suspicious user step to catch it at.
vulncheck2026context
The NVD record for CVE-2026-75130 references no fixed version and lists affected versions as 0 through 2.1.2; the Context7 npm package has since progressed to 4.0.x, and no advisory confirms whether current releases remain affected.
Why it mattersWithout a named fixed version, 'just upgrade' is not actionable - teams cannot tell whether the version they run is patched.
nvdnistnati2026cve
A distinct earlier Context7 flaw disclosed by Noma Security ('ContextCrush', same Custom Instructions surface, no CVE assigned) was discovered 18 February 2026, patched by Upstash 23 February 2026 and publicly disclosed 5 March 2026.
Why it mattersThe same feature producing a second disclosure months later signals the injection surface, not a single bug, is the durable problem.
nomasecurit2026contextcr
Under the Cyber Resilience Act, Regulation (EU) 2024/2847, the Article 14 reporting obligations apply from 11 September 2026: a manufacturer that becomes aware of an actively exploited vulnerability in its product must send an early warning within 24 hours, a notification within 72 hours, and a final report within 14 days of a corrective measure, to the coordinating CSIRT and ENISA via the Single Reporting Platform.
Why it mattersTwenty-four hours is a detection-and-inventory deadline, not an investigation window; it only works if 'which of our products contains this component' is already answerable.
europeancom2026cra · crowellmori2026eu
The CRA reporting duty applies to manufacturers of products with digital elements marketing in the EU, including non-EU companies; non-commercial open-source software is out of scope, but once open-source software is integrated into a product supplied commercially, the manufacturer must exercise due diligence.
Why it mattersAn agent product that bundles an open-source MCP server does not inherit the OSS exemption - the integrator owns the due-diligence and reporting duty.
europeancom2026cra · crowellmori2026eu

Sources

Crowell & Moring LLPsecondary
crowellmori2026eu
Original Archived PDFretrieved 24 August 2026 · published 1 January 2026
European Commissionprimary source
CRA reporting obligations
Original Archived PDFretrieved 6 October 2026 · published 11 September 2026
Noma Securitysecondary
nomasecurit2026contextcr
Original Archived PDFretrieved 24 August 2026 · published 5 March 2026
NVD (NIST National Vulnerability Database)primary source
nvdnistnati2026cve
Original Archived PDFretrieved 24 August 2026 · published 18 August 2026
VulnCheckprimary source
vulncheck2026context
Original Archived PDFretrieved 24 August 2026 · published 18 August 2026

Every source for this edition, as one PDF BibTeX — all editions

Corrections

What changed after publication

- Kept the February ContextCrush flaw (no CVE, patched 23 Feb 2026) strictly distinct from the August CVE-2026-75130; did not conflate the two despite the shared Custom Instructions surface and shared researcher. - Presented 9.0 (CVSS 3.1) and 6.4 (CVSS 4.0) as one CNA's two scales, not a dispute between parties. - Did not claim CVE-2026-75130 is actively exploited; the CRA 24-hour duty is stated as conditional on exploitation.