Severity: HighVulnerabilityMCP/tool abuse
Confused-deputy flaw lets one tenant's agent invoke another's tools
EU
Sample data. Showing illustrative sample items as a fallback — the live feed is not available right now.
A gateway authorisation gap allowed an agent in one tenant to call tools registered by another tenant by replaying a stale session scope. The issue stemmed from trusting client-supplied scope claims instead of re-deriving them server-side.
What to do
Re-derive authorisation scope at the gateway on every call, never trust client-supplied scope, and segment tool access per identity and tenant.
Mapped framework pillars
Sources
CVE references
- CVE-SAMPLE-002(sample — not a real CVE)
#confused deputy#authorization#multi-tenant