Case smithery-mcp-hosting-traversalAI supply chainWorldwide
Path traversal in Smithery MCP hosting exposed root access to 3,000 hosted MCP servers
GitGuardian showed that an unvalidated dockerBuildPath in smithery.yaml let a malicious Dockerfile read the builder's home directory and steal a fly.io token giving root on more than 3,000 hosted MCP servers and visibility of customer API keys.
MediumAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Oct 15, 2025
- Location
- Worldwide
- Target
- Smithery.ai hosted MCP servers
- Severity
- Medium
- Triggered by
- GitGuardian researchers
- Actor type
- Security researchers
- Reported loss
- None reported
- CVE
- None
What happened
GitGuardian showed that an unvalidated dockerBuildPath in smithery.yaml let a malicious Dockerfile read the builder's home directory and steal a fly.io token giving root on more than 3,000 hosted MCP servers and visibility of customer API keys.
Impact: Demonstrated root command execution on hosted MCP servers and capture of a customer API key in traffic; secrets of thousands of customers across hundreds of services could have been exposed
Who triggered it
Actor: GitGuardian researchers
Attribution: Discovered and responsibly disclosed by GitGuardian; Smithery acknowledged and fixed the flaw and found no evidence of exploitation
Motive: Security research into MCP hosting platforms
How it happened
Attack vector: Setting dockerBuildPath to a parent directory so the Docker build context included the builder's .docker/config.json containing an overprivileged fly.io token
Root cause: Unvalidated build configuration plus a shared, overprivileged platform credential with access to the fly.io Machines API
Timeline
- GitGuardian discovers the path traversal
- Proof of concept disclosed to Smithery, which acknowledges it the same day
- Partial fix deployed and compromised token rotated
- Complete fix deployed
- GitGuardian publishes the write-up
Response
Smithery rotated the token and fixed the build path validation within two days of disclosure
Current status: Patched
Sources (open in a new tab)
- GitGuardian blog.gitguardian.com
- SC World scworld.com
Cite this case
Path traversal in Smithery MCP hosting exposed root access to 3,000 hosted MCP servers. AI Threat Watch, case smithery-mcp-hosting-traversal, Oct 15, 2025. https://aithreat.io/cases/smithery-mcp-hosting-traversal/
Permanent link: https://aithreat.io/cases/smithery-mcp-hosting-traversal/