用于 Agent 间通信的 MCP，可能是你从未听说过的最高风险协议

“AI Agent 为攻击者提供了一组可横向穿越的新连接，”Rapid7 漏洞情报总监 Douglas McKee 告诉 Ars。“有人在内容中植入文本，一个 Agent 会读取它，然后将其作为普通的委派任务传递给另一个 Agent；第二个 Agent 会执行它，因为它信任把任务交给它的一方。这条链上的每一个环节都完全按照设计运行，这也正是此类问题如此难以发现的原因。每种协议在设计时都假定自己独立运行，因此各自都会检查自己的前门，却没有人监视中间的走廊。”

Mohiuddin 在 Rapid7 网络中发现的漏洞 CVE-2026-97228，严重性评分仅为 10 分制中的 2.7 分。Rapid7 已于上个月修复该漏洞。

影响 Google 的漏洞则更为严重，评分为 8 分。该问题源于一个用于数据库的 MCP 工具箱（googleapis/mcp-toolbox）：其初始化 HTTP 客户端时未使用 CheckRedirect 策略。CheckRedirect 是一组用于控制服务器如何处理 URL 返回错误或重定向至其他 URL 情况的设置。Google 的 HTTP 客户端也未能验证目标 IP 地址。

“经过构造的路径参数可能使该工具箱跟随重定向访问内部端点，并代表攻击者发送请求，”Mohiuddin 解释道。Google 的修复措施包括应用 IP 地址范围允许列表和阻止列表。“它会在启动时拒绝不安全的基础 URL，而不是等到第一次请求时才拒绝。这才是真正的 SSRF 防护。它的工作量也比大多数 MCP 服务器所做的更多。”

Mohiuddin 将这类攻击称为“协议枢纽转移”（protocol pivoting），因为当某个应用或服务器使用 MCP 将任务分配给一个 Agent，而该 Agent 随后通过另一种通信方式——例如用于 Agent 间委派的 Google Agent-to-Agent（A2A）协议，或 Agent Network Protocol 等新兴标准——将恶意指令转发给另一个 Agent 时，攻击便会奏效。他表示，信任或授权往往会在这一过程中事实上“失真丢失”。他将协议枢纽转移描述为：“一种多步骤攻击：攻击者通过一种协议获得初始访问权限，利用协议之间的信任假设，并将权限升级至仅可通过另一种协议访问的能力。”

“AI agents give attackers a fresh set of connections to walk across,” Douglas McKee, director of vulnerability intelligence at Rapid7, told Ars. “Someone plants text in content, an agent will read it then pass it along to another agent as a normal delegated task, and that second agent runs it because it trusts whoever handed it the work. Every piece in that chain did exactly what it was designed to do, which is what makes this so tricky to catch. Each protocol was built assuming it lived on its own, so each one checks its own front door while nobody watches the hallway in between.”

CVE-2026-97228, the vulnerability Mohiuddin found in Rapid7’s network, carried a severity rating of only 2.7 out of 10. Rapid7 fixed it last month.

The vulnerability affecting Google was more severe, with a rating of 8. It stemmed from an MCP toolbox for databases (googleapis/mcp-toolbox) initializing its HTTP client with no use of a CheckRedirect policy, a series of settings that control how a server is to handle cases of a URL either returning an error or redirecting to a different URL. Google’s HTTP client also failed to validate target IP addresses.

“A crafted path parameter could make the toolbox follow a redirect to an internal endpoint and send requests on the attacker’s behalf,” Mohiuddin explained. Google’s fix involved applying an allow-list of IP ranges and block lists. “It rejects an unsafe base URL at startup instead of on first request. That is what a real SSRF guard looks like. It is also more work than most MCP servers have done.”

Mohiuddin is calling the class of attack “protocol pivoting” because the exploits work when an app or server uses MCP to assign a task to an agent and the agent then forwards malicious instructions to another agent using a different communication method such as Google’s Agent-to-Agent (A2A) protocol, used for inter-agent delegation, or emerging standards such as the Agent Network Protocol. Often, he says, trust or authorization gets effectively lost in translation. He described protocol pivoting as “a multi-step attack in which an adversary gains initial access through one protocol, exploits trust assumptions between protocols, and escalates to capabilities only accessible via a different protocol.”