---
title: OWASP MCP Top 10 Vulnerability Index
description: Index of OWASP MCP Top 10 (2025) vulnerability identifiers, categories, and cross-references
---

# 00 Vulnerability Index

This document provides the index for the OWASP MCP Top 10 (2025) vulnerabilities.
Each entry includes its identifier, title, and primary attack category.

## Vulnerability catalog

| ID         | Title                                                  | Category                 |
|------------|--------------------------------------------------------|--------------------------|
| MCP01:2025 | Token Mismanagement and Secret Exposure                | Credential Hygiene       |
| MCP02:2025 | Privilege Escalation via Scope Creep                   | Access Control           |
| MCP03:2025 | Tool Poisoning                                         | Supply Chain / Integrity |
| MCP04:2025 | Software Supply Chain Attacks and Dependency Tampering | Supply Chain / Integrity |
| MCP05:2025 | Command Injection and Execution                        | Injection                |
| MCP06:2025 | Prompt Injection via Contextual Payloads               | Injection                |
| MCP07:2025 | Insufficient Authentication and Authorization          | Access Control           |
| MCP08:2025 | Lack of Audit and Telemetry                            | Observability            |
| MCP09:2025 | Shadow MCP Servers                                     | Governance               |
| MCP10:2025 | Context Injection and Over-Sharing                     | Data Isolation           |

## Cross-reference matrix

Each vulnerability document follows a consistent structure:

1. Description — what the vulnerability is and why it matters in MCP contexts.
2. Impact — concrete consequences of exploitation.
3. Vulnerability checklist — indicators that the environment is exposed.
4. Prevention controls — defensive design patterns and governance.
5. Example attack scenarios — realistic exploitation narratives.
6. Detection guidance — signals and indicators of compromise.
7. Remediation — immediate actions to contain and resolve.

## Category groupings

### Injection

* MCP05:2025 Command Injection and Execution
* MCP06:2025 Prompt Injection via Contextual Payloads

### Access Control

* MCP02:2025 Privilege Escalation via Scope Creep
* MCP07:2025 Insufficient Authentication and Authorization

### Supply Chain and Integrity

* MCP03:2025 Tool Poisoning
* MCP04:2025 Software Supply Chain Attacks and Dependency Tampering

### Credential Hygiene

* MCP01:2025 Token Mismanagement and Secret Exposure

### Data Isolation

* MCP10:2025 Context Injection and Over-Sharing

### Observability

* MCP08:2025 Lack of Audit and Telemetry

### Governance

* MCP09:2025 Shadow MCP Servers
---

