AIA-014 Cursor MCP one-time approval could be reused after config change (CVE-2025-54136, "MCPoison"), per Check Point Research

ID: AIA-014
Category: AI AI agent incident
Disclosed: 2025-08
Systems: Cursor
Harm type: Code exec / supply chain
Status: fixed
Check Point Research says it disclosed the issue on July 16, 2025, that Cursor issued version 1.3 on July 29, 2025, and that "our independent testing confirms that the issue has been effectively addressed" (release notes did not mention it).
CVE: CVE-2025-54136
CISA KEV: Not in CISA KEV as of catalog 2026.10.30
Checked 2026-10-31 against catalog 2026.10.30

Summary

Check Point Research reported that "once an MCP is approved, future modifications to its command or arguments are trusted without any additional validation or prompt," which could let a changed shared config run commands persistently.

Controls

Controls that could prevent, detect, or support recovery from this kind of failure. Mappings are editorial judgments made by the method, not findings about what any party should have done.

NIST AI RMF

MAP 4.1 Risks from third-party components are mapped
MEASURE 2.7 Security and resilience are evaluated and documented

NIST SP 800-53

CM-3 Configuration Change Control
CM-5 Access Restrictions for Change
SI-7 Software, Firmware, and Information Integrity

Human-approval (JCR) checkpoint

partial: MCP configuration approval, bypassed by later changes

Correlated incidents

Co-occurrence, not cause: each link records something the two incidents share, as its rationale and source state. It does not say one incident caused the other. Links are written on one record; the other record shows the same link marked derived.

Cyber CYB-007 MCP Inspector below 0.14.1 allowed unauthenticated remote code execution, per GitHub advisory

same technique derived from CYB-007

Both involve MCP tooling leading to command execution: unauthenticated requests could launch MCP commands through the Inspector proxy, and Check Point Research reports a changed, previously approved MCP config in Cursor could run commands.

Source: research.checkpoint.com https://research.checkpoint.com/2025/cursor-vulnerability-mcpoison/

Sources

research.checkpoint.com primary link checked 2026-10-31, HTTP 200
Post dated August 5, 2025
https://research.checkpoint.com/2025/cursor-vulnerability-mcpoison/

Corrections

No corrections recorded.

To report an error in this entry, see corrections.