Mittwald mStudio MCP server intrusion

Summary

On November 7, 2026, the German web host Mittwald disclosed that an intruder had used a vulnerability in its MCP server, the component that lets customers connect AI assistants to its mStudio platform, to reach 56 customer projects. Mittwald said the intruder went unnoticed for about eight days and that it treats all data in those projects from October 27 onward as compromised. Recovery and forensic analysis are ongoing.

What happened

• Mittwald said the intruder first tested a flaw in the MCP server on October 21 and registered ordinary user accounts on the platform in the following days.
• According to Mittwald, the intruder exploited the MCP server flaw on October 27, a few minutes after registering another account.
• Mittwald said it noticed unusual behavior on November 4, identified the MCP server as the entry point, and shut it down.
• The company said it locked affected projects, paused new registrations, and temporarily blocked mStudio logins and SSH access to customer projects.
• Mittwald said it informed the responsible authorities on November 5. It did not name them.
• Managing director Robert Meyer told The Record that log timing, with seconds between steps, points to the use of AI tools by the intruder.

Timeline

• 2026-10-21 - Intruder first probes the MCP server vulnerability, according to Mittwald.
• 2026-10-27 - Intruder exploits the flaw; Mittwald treats project data from this date as compromised.
• 2026-11-04 - Mittwald detects the activity, blocks access, and shuts down the MCP server.
• 2026-11-05 - Mittwald locks affected projects and informs authorities.
• 2026-11-07 - Mittwald restores mStudio and SSH access and publishes its disclosure.

What the vendor has confirmed

Mittwald confirmed that a vulnerability in its MCP server was the entry point and that 56 customer projects were compromised. It said its separate customer center was never affected and that no further intruder activity was found after repeated scans on November 6.

What remains unclear

• Mittwald has not said whether the flaw sat in its own code or in an open source MCP library.
• The types of data accessed, and whether any data was copied out, have not been disclosed.
• The AI attribution rests on log timing; Mittwald has not published other evidence.
• A promised technical account is not yet published.

Broader context

Servers that connect AI assistants to production accounts hand an automated client broad, credentialed reach into customer systems. That makes the connector itself a privileged entry point, and a single flaw there can open many tenants at once.

Sources

• Mittwald blog: Sicherheitsvorfall am MCP-Server, November 7, 2026 (vendor-disclosure)
• The Record coverage (press)