What is CVE-2026-9680?

CVE-2026-9680 is a medium-severity vulnerability in Alibaba Cloud Rds Openapi Mcp Server, classified under Initialization of a Resource with an Insecure Default. CVSS score: 5.8/10. Published 2026-07-28.

How severe is CVE-2026-9680?

Medium severity. CVSS v3 base score is 5.8 out of 10.

RCE in Alibaba Cloud Rds Openapi Mcp Server

CVE-2026-9680

Improper exposure of the MCP server in alibabacloud-rds-openapi-mcp-server allows remote attackers to invoke exposed MCP tools via network access to an MCP endpoint listening on all network interfaces by default.

CVSS v3 metric

CVSS v3 base score 5.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N.

Affected products

Alibaba Cloud Rds Openapi Mcp Server — versions 1.8.0

Weakness classification (CWE)

CWE-1188 — Initialization of a Resource with an Insecure Default

References

alibaba-cna@list.alibaba-inc.com

Frequently asked questions

What is CVE-2026-9680?: CVE-2026-9680 is a medium-severity vulnerability in Alibaba Cloud Rds Openapi Mcp Server, classified under Initialization of a Resource with an Insecure Default. CVSS score: 5.8/10. Published 2026-07-28.
How severe is CVE-2026-9680?: Medium severity. CVSS v3 base score is 5.8 out of 10.