Skip to main content
The MCP client tricks the MCP server into performing actions exceeding the MCP client’s authority.

​
How to resolve

Implement explicit user intent verification: For sensitive operations, require explicit user confirmation that cannot be bypassed through prompt manipulation. Use out-of-band verification for high-risk actions. Apply principle of least privilege: Limit the LLM’s access to only the minimum tools and data necessary for its function. Avoid granting blanket access to resources based solely on user identity. Use context-aware authorization: Implement authorization checks that consider the full context of requests, including the source of instructions and the reasonableness of operations, not just user identity. Deploy defense-in-depth: Combine multiple security controls including input validation, output filtering, authorization checks, and audit logging to make confused deputy attacks more difficult to execute successfully. Robust authentication for MCP proxy servers: MCP proxy servers must implement per-client consent that runs before the third-party authorization flow.

​
Risk

Governance/Compliance Confused deputy vulnerabilities violate multiple security standards:
  • OWASP Top 10 for LLM Applications (LLM06:2025, LLM01:2025): Excessive agency and prompt injection allow attackers to manipulate LLMs into misusing their legitimate access to tools and data.
  • NIST AI RMF (GOVERN-2.1, MAP-2.3): Fails to establish accountability for AI system actions and does not adequately assess AI system capabilities and their potential for misuse.
  • ISO/IEC 42001 (Authorization and Access Control): Does not enforce proper authorization boundaries within AI management systems, allowing delegated access to be exploited.
  • EU AI Act (Articles 9, 13): Undermines risk management and transparency obligations by enabling opaque, unauthorized actions through trusted intermediaries.
  • OWASP MCP Top 10 (MCP10:2025 - Context Injection & Over-Sharing): Enables context manipulation that causes the LLM to over-share sensitive information or perform unintended actions.
Security The confused deputy problem is particularly dangerous in LLM systems because the model has legitimate access to sensitive tools and data on behalf of users, but may be manipulated through prompt injection or other attacks to misuse that access. Unlike traditional confused deputy attacks, the LLM’s natural language interface makes it easier for attackers to craft convincing instructions that appear legitimate. This can lead to privilege escalation, unauthorized data access, or execution of harmful commands using the user’s credentials.

​
Explanation

Some of the ways in which this vulnerability is exploited is by having a third-party attacker that impersonates the honest MCP client, or by exploiting other vulnerabilities like prompt injection or tool shadowing to trick the LLM into performing operations beyond what the authorized user can do.

​
Specifications

Trigger
  • MCP server scan detects architectural patterns where the MCP client acts as a privileged intermediary that could be manipulated to misuse its authority through other vulnerabilities
Severity
  • CRITICAL
Applies to: MCP Server