# Alleged AI-aided attack exploits MCP server flaw to breach German web host Mittwald (56 customer projects compromised)

> An attacker, allegedly assisted by AI tooling, exploited an unspecified flaw in Mittwald's Model Context Protocol (MCP) server, which connects AI assistants to the mStudio hosting management platform, from a freshly registered user account on 2026-10-27. The intrusion went undetected for eight days and compromised 56 customer projects at Mittwald CM Service in Germany. No CVE, malware name or attacker IOCs have been published.

- **Published:** 2026-11-09T14:30:01Z
- **Last reviewed:** 2026-11-09T14:30:01Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5558
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5558.png
- **ID:** TL-2026-5558
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 6 (2 shown free below)

## Description

Mittwald CM Service, a German hosting provider serving web agencies in North Rhine-Westphalia, disclosed on Saturday 2026-11-07 a security incident at its MCP server. The MCP server (public endpoint mcp.mittwald.de, fronted by an OAuth bridge at auth.mcp.mittwald.de) lets customers connect AI assistants to mStudio, the platform used to manage websites and hosting services. Per Mittwald's own timeline, the attacker first probed the MCP server on the evening of 2026-10-21, the same evening the PHP2Shell PHP vulnerabilities (CVE-2026-109618 / CVE-2026-109619) dominated IT news. On 2026-10-23 the attacker behaved like a regular user: registering test accounts, using extensions and attempting simple injections. On 2026-10-27 at 14:58 the attacker registered another account and at 15:03 used it to exploit the MCP server flaw.

Mittwald detected unusual behaviour in one system on the morning of 2026-11-04 (eight days after exploitation), blocked the first attacker account at 11:11, set its status page to investigation at 12:53, and took parts of the systems offline that evening, identifying the MCP server as the entry point and shutting it down. Early on 2026-11-05 projects carrying traces of the attacker were locked and new account registration was temporarily disabled; later that day mStudio login and SSH access to customer projects were blocked. On 2026-11-06 the 56 compromised projects and the MCP server were forensically analysed with external IT forensic experts, and repeated scans found no further compromised projects. mStudio and SSH access were restored on 2026-11-07 and passkey setup was introduced. Mittwald treats all data from 2026-10-27 onward as compromised; no specific data types or confirmed exfiltration were listed. The Customer Center and customer websites managed there were reportedly not affected. Relevant authorities were informed.

Mittwald attributes the speed of the activity to possible AI assistance: logs show only seconds between steps that would take a human attacker significantly longer, and the attacker disguised access attempts and used diversionary tactics. Mittwald offered no further evidence of AI use and did not respond when asked to distinguish AI tooling from conventional scripts, so the AI-aided characterisation remains alleged. It is also unclear whether the flaw lies in Mittwald's own code or in open-source MCP libraries. No link to PHP2Shell is established beyond timing. Mittwald has promised a detailed write-up the following week; this record should be updated when it is published. Note: Mittwald's open-source MCP server (github.com/mittwald/mcp-server) is documented as exposing 116 tools for managing hosting infrastructure with OAuth 2.1 Authorization Code + PKCE and Dynamic Client Registration; this describes the product, not the confirmed vulnerable component.

## MITRE ATT&CK

- T1595 Active Scanning
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1036 Masquerading

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**MCP Server Injection-Style Probing and Error Bursts (Mittwald MCP Incident)** (`TL-2026-5558-SPL-001`)

Behavior-first hunt for the exploitation pattern reported in TL-2026-5558: simple injection attempts and error-heavy, multi-path request bursts against an internet-facing MCP server (mcp.mittwald.de/mcp) and its OAuth bridge (auth.mcp.mittwald.de). Mittwald reported injection attempts on 2026-10-23 and exploitation of an unspecified MCP flaw on 2026-10-27 (T1190), preceded by probing (T1595). The flaw itself is undisclosed, so this rule keys on injection-style URI content and error bursts per source rather than a specific exploit signature. Note: MCP JSON-RPC bodies are not visible in access logs; pair with application-level MCP tool-call logging where available.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1595
- **Data sources:** web_access_logs (index=web, sourcetype=access_combined), reverse_proxy_or_waf_logs (Sentinel CommonSecurityLog), webserver (Sigma logsource category)
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=web sourcetype=access_combined earliest=-24h (host="mcp.mittwald.de" OR host="auth.mcp.mittwald.de" OR uri_path="/mcp*") | eval src_ip=coalesce(src_ip,clientip,src) | eval inj=if(match(coalesce(uri_query,""),"(?i)(union.{1,6}select|%27|[.][.]/|%2e%2e|[$][{]|[{][{]|;.{0,3}(whoami|curl|wget))"),1,0) | eval err=if(status>=400,1,0) | fillnull value="-" user | bin _time span=5m | stats count AS reqs sum(inj) AS inj_hits sum(err) AS errs dc(uri_path) AS paths values(status) AS statuses BY _time src_ip user | where inj_hits>=3 OR (reqs>=30 AND errs>=10 AND paths>=5) | table _time src_ip user reqs inj_hits errs paths statuses
```

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestURL has 'mcp.mittwald.de' or RequestURL has '/mcp'
| extend Inj = iff(RequestURL matches regex @'(?i)(union.{1,6}select|%27|[.][.]/|%2e%2e|[$][{]|[{][{]|;.{0,3}(whoami|curl|wget))', 1, 0)
| summarize Reqs = count(), InjHits = sum(Inj), UniqueUrls = dcount(RequestURL) by SourceIP, bin(TimeGenerated, 5m)
| where InjHits >= 3 or (Reqs >= 30 and UniqueUrls >= 10)
| project TimeGenerated, SourceIP, Reqs, InjHits, UniqueUrls
```

### Sigma

```yaml
title: Injection-Style Request Content Against MCP Server Endpoints
id: 7c3e5a10-4b2d-4f8e-9a61-d2e0b5c73a11
status: experimental
description: Detects injection-style payload fragments (SQLi, path traversal, template/shell injection) in requests to MCP server endpoints, matching the simple injection attempts reported in the Mittwald MCP server incident (TL-2026-5558). Burst thresholds are implemented in the SPL/KQL flavors.
references:
  - https://www.mittwald.de/blog/mittwald/sicherheitsvorfall-am-mcp-server
  - https://therecord.media/cyberattack-germany-ai-mittwald
author: Threadlinqs Team
date: 2026-11-09
tags:
  - attack.initial-access
  - attack.t1190
  - attack.reconnaissance
  - attack.t1595
logsource:
  category: webserver
detection:
  selection_target:
    - cs-host|endswith: 'mcp.mittwald.de'
    - c-uri|startswith: '/mcp'
  selection_inj:
    cs-uri-query|contains:
      - '%27'
      - 'union select'
      - 'union%20select'
      - 'union+select'
      - '../'
      - '%2e%2e'
      - '${'
      - '{{'
      - ';whoami'
      - ';curl'
      - ';wget'
  condition: selection_target and selection_inj
falsepositives:
  - Authorized penetration tests or vulnerability scans against the MCP endpoint
  - Legitimate clients sending URL-encoded apostrophes in search parameters
level: high
```

**Known false positives:**

- Authorized vulnerability scanners or penetration tests against the MCP endpoint
- Legitimate API clients that URL-encode apostrophes in query parameters
- Developer load tests producing many 4xx responses from one source

**Tuning notes:** The access_combined host field is the logging server; if vhost is not logged, rely on uri_path=/mcp* and add the vhost to the log format. Allow-list scanner and pentest source IPs. Tune inj_hits and the reqs/errs/paths thresholds to the endpoint's normal traffic. Add MCP application logs (tool name, authenticated user) for body-level injection visibility.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Burst of OAuth Dynamic Client Registration / Account Signup Requests at MCP Auth Bridge (locked: unlock with TL Creds)
- Web or App Server Process Spawning Shell or Downloader on Hosting Node (locked: unlock with TL Creds)
- Machine-Speed Request Cadence Against MCP Endpoint With Browser-Like User-Agent (locked: unlock with TL Creds)
- Scanner Tooling or Sensitive-Path Probing Against MCP Server Hosts (locked: unlock with TL Creds)
- PHP Script or Web Shell Written Into Web Root by Shell or Download Utility (locked: unlock with TL Creds)
- Connections to Community-Observed Sibling Infrastructure (Low-Confidence Watchlist) (locked: unlock with TL Creds)
- New Account Registration Followed Rapidly by MCP Tool Activity (locked: unlock with TL Creds)
- SSH Fan-Out Across Many Hosting Projects From One Source (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 6)

Defanged, TLP:CLEAR.

- Domain: `mcp[.]mittwald[.]de`
- URL: `hxxps://github[.]com/mittwald/mcp-server`

Full set of 6 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Alleged AI-aided cyberattack exploits assistant interface to breach German web host](https://therecord.media/cyberattack-germany-ai-mittwald)
- [Mittwald: Sicherheitsvorfall am MCP-Server](https://www.mittwald.de/blog/mittwald/sicherheitsvorfall-am-mcp-server)
- [The Record: PHP script vulnerability warnings (PHP2Shell context)](https://therecord.media/php-script-vulnerabilities-warnings)
- [mittwald/mcp-server (GitHub repository)](https://github.com/mittwald/mcp-server)
- [Mittwald MCP Server listing (Glama)](https://glama.ai/mcp/servers/mittwald/mcp-server)
- [High-risk tools in Mittwald MCP Server (PolicyLayer)](https://policylayer.com/risk/high/mittwald-mcp-server)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5558