Cursor MCPoison: approved MCP server config can be silently swapped
Date: 2025-08
Affected: Cursor IDE
Attack vector: auth-bypass
Category: real-world
Severity: High
CVE: CVE-2025-54136
CWE: CWE-78
CVSS: 7.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Cursor MCPoison: once an MCP server (mcp.json) is approved by the user, any subsequent changes to its content are silently trusted because approval is bound by MCP name not contents. Attacker modifies the config to include malicious commands that execute without re-approval.


Mitigations:

Architectural layers (MAESTRO):