Payload MCP plugin API key access control flaw
Start here
Payload published a security advisory stating that under certain conditions, authenticated users can manage MCP API keys that do not belong to their accounts, allowing attackers to escalate privileges and achieve account takeover. This issue only affects applications using @payloadcms/plugin-mcp. The official fix is available in 3.88.0 and later versions, and an upgrade is recommended; before upgrading, you can disable the MCP plugin or restrict MCP API key management permissions to trusted users.
Generated by AI from reports · Updated 4 days ago
Progress timeline
- GitHub 安全公告Payload fixed an access control flaw in MCP API keys that could lead to account takeover
Payload published a security advisory stating that under certain conditions, authenticated users can manage MCP API keys that do not belong to their accounts, allowing attackers to escalate privileges and achieve account takeover. This issue only affects applications using @payloadcms/plugin-mcp. The official fix is available in 3.88.0 and later versions, and an upgrade is recommended; before upgrading, you can disable the MCP plugin or restrict MCP API key management permissions to trusted users.
Related discussion
Attention trend
New sources per day
- Oct 7: 1 new sources (1 outlets, 0 accounts)
- Oct 8: 0 new sources (0 outlets, 0 accounts)
- Oct 9: 0 new sources (0 outlets, 0 accounts)
- Oct 10: 0 new sources (0 outlets, 0 accounts)
- Oct 11: 0 new sources (0 outlets, 0 accounts)
- Oct 12: 0 new sources (0 outlets, 0 accounts)
- Oct 13: 0 new sources (0 outlets, 0 accounts)
- Oct 14: 0 new sources (0 outlets, 0 accounts)