The courier, not the victim - a Context7 MCP flaw meets the CRA reporting clock

Upstash's Context7 - the MCP server that feeds up-to-date library documentation to AI coding agents - carries CVE-2026-75130, disclosed 18 August 2026: poisoned Custom AI Instructions can make a connected agent, during a routine docs request, exfiltrate .env credentials and delete files on the developer's machine. The same analyst rates it 9.0 Critical (CVSS 3.1) and 6.4 Medium (CVSS 4.0) because the 4.0 vector scores the server's own confidentiality, integrity and availability as None while the developer machine downstream scores High - the server is the courier, not the victim. No fixed version is named; the same feature was hit and patched in February. The EU consequence is the Cyber Resilience Act: an MCP server is a product with digital elements, and Article 14's reporting duty starts 11 September 2026, putting a 24-hour clock on the manufacturer of any component whose vulnerability is being exploited.

Post

Your coding agent asks Context7 for a library's docs fifty times a day. Last week's disclosure showed that same request can carry someone else's instructions back to your machine.

CVE-2026-75130, published 18 August, sits in Upstash's Context7 — the MCP server that feeds up-to-date library docs to AI coding agents. Poison its Custom AI Instructions and, on a routine docs lookup, the agent can be told to read your .env, ship the keys to an attacker-controlled service, and delete files on your machine.

Now the part worth slowing down for.

The same analyst scored it twice: 9.0 Critical under CVSS 3.1, 6.4 Medium under CVSS 4.0. Not a disagreement — two scales. The newer one is the more honest, rating Context7's own confidentiality, integrity and availability as none. The server is not the victim. It is the courier. The impact lands downstream — on your laptop and the agent that trusted it.

The same feature was hit in February by the same researcher and patched in days. The August CVE lists no fixed version; the package has since moved to 4.0.x, and no advisory confirms the current release is clear.

Now the European part.

An MCP server is software marketed under a maker's name. Under the Cyber Resilience Act — Regulation (EU) 2024/2847 — that makes it a product with digital elements. Article 14's reporting duty starts 11 September, eighteen days out. Learn that a vulnerability in your product is being exploited, and you owe an early warning within 24 hours, a notification within 72, and a final report within 14 days of a fix — to a national CSIRT and ENISA.

The reasonable reading is that this is Upstash's bug to fix — except the impact never touches Upstash, and once exploited, the reporting clock is the maker's, not the user's.

What I'd do Monday:

  1. Inventory your MCP servers as dependencies. Pin versions. "Latest" is not a supply-chain policy.
  2. Run agents with no ambient credentials in reach. The exfiltration path is reading env vars.
  3. Treat every MCP tool response as untrusted input.
  4. Shipping an agent product in the EU? Map that supply chain now — an exploited flaw in a component is a 24-hour clock.

Which of your agent's dependencies could read your .env — and would you know within a day if one was being used against you?

#AIregulation #CyberResilienceAct #AgenticAI #MCP #AIcodingAgents

First comment

Sources —

NVD entry for the CVE (vendor, affected versions, both CVSS vectors): https://nvd.nist.gov/vuln/detail/CVE-2026-75130

VulnCheck advisory (attack mechanism, the CVSS 4.0 reasoning): https://www.vulncheck.com/advisories/context7-prompt-injection-via-custom-ai-instructions

The February sibling flaw in the same feature, since patched (Noma Security): https://www.noma.security/blog/contextcrush-context7-the-mcp-server-vulnerability

Cyber Resilience Act reporting obligations, official EU page: https://digital-strategy.ec.europa.eu/en/policies/cra-reporting

Cut for length: the CRA's open-source carve-out. Non-commercial open source is out of scope — but once it is integrated into a product supplied commercially, the due diligence is the integrator's. "We just wired up an open-source MCP" is not an exemption.

Claims

Sources

Corrections

  • Kept the February ContextCrush flaw (no CVE, patched 23 Feb 2026) strictly distinct from the August CVE-2026-75130; did not conflate the two despite the shared Custom Instructions surface and shared researcher.
  • Presented 9.0 (CVSS 3.1) and 6.4 (CVSS 4.0) as one CNA's two scales, not a dispute between parties.
  • Did not claim CVE-2026-75130 is actively exploited; the CRA 24-hour duty is stated as conditional on exploitation.

AI disclosure

The video for this edition contains AI-generated media: the narration is a synthetic voice and the cover art is generated. The script, the claims and the source verification are human-authored and human-checked. Assets carry IPTC DigitalSourceType and C2PA Content Credentials.