# Taxonomy v2.6

Definitions from the existing reviewed taxonomy; publication preview uses null for unknown fields.

## Primary vulnerability type

Choose one dominant evidenced mechanism. Prefer a specific injection, confinement or trust failure over its impact. Browser script injection remains XSS even when it reaches native code; executing arbitrary code does not by itself establish command injection. Classify intentional command-launching features reached through missing approval/authentication under the failed gate, unless a separate injection mechanism is the primary reported flaw. For overlapping injection and policy failures, use the evidenced primary mechanism and represent independently supported control failures in root causes.

| Stable name | Include | Exclude / boundary | Reviewed example |
|---|---|---|---|
| Command Injection | Untrusted data changes shell/OS command interpretation | CLI option injection without shell interpretation; legitimate command launch behind a broken approval gate | CVE-2025-53107 |
| Argument Injection | Untrusted values become unintended CLI flags/options | Shell metacharacter execution; ordinary invalid arguments | CVE-2025-68144 (`git_diff` / `git_checkout`) |
| Code Injection | Untrusted text is evaluated as general-purpose language code | Browser rendering XSS; shell syntax; intentionally accepted programs with failed sandbox permissions; execution whose mechanism is unknown | CVE-2025-59528 (`Function`) |
| Path Traversal | Escape from intended filesystem/repository confinement, including symlinks, prefixes and absolute paths; URL path dot-segments that escape the intended API endpoint | Generic file disclosure without a demonstrated confinement failure; sensitive-descendant permission failures with no path escape | CVE-2025-67364, CVE-2025-68145 |
| SSRF | Attacker controls destinations of server-side requests outside intended scope | Direct browser requests; disclosure without request redirection | CVE-2025-11286, CVE-2025-5276, CVE-2025-59155 |
| SQL Injection | Untrusted content changes SQL statement structure or intended query context | An intentionally accepted query language with only an inadequate read-only policy | CVE-2025-66335, CVE-2025-66336 |
| XSS | Attacker-controlled rendered content or script gadget executes browser/renderer JavaScript | Backend language evaluation; native execution without a rendering injection | CVE-2025-58357, CVE-2025-66562 |
| Authentication Bypass | Missing/bypassed identity verification enables access | Valid identity with insufficient permissions; approval UI; session binding | CVE-2025-13822, CVE-2025-49596 |
| Authorization Bypass | Permissions, allowed operations or capability restrictions fail for an actor | Identity verification; user approval/configuration trust; a more specific dominant injection | CVE-2025-5071, CVE-2025-59376 |
| Configuration Trust or Approval Bypass | Untrusted executable configuration is accepted, or required approval/disclosure/reapproval is bypassed | Shell escaping flaws; generic authentication or account permissions | CVE-2025-54136, CVE-2025-68433; direct custom-URL configuration in CVE-2025-58176 |
| Session or Peer Binding Failure | Sessions, authorization exchanges or tokens are not bound to the correct client, callback, resource or peer | Generic missing login; DNS rebinding; violation only of a one-use invariant is Replay Protection Failure | CVE-2025-4143, CVE-2025-4144, CVE-2025-6515, CVE-2025-69196 |
| DNS Rebinding | Explicitly documented DNS-rebinding mechanism | Any localhost/browser attack without evidence of DNS manipulation | CVE-2025-10193, CVE-2025-66414 |
| Hardcoded Credentials | Known embedded/default credentials remain usable as secrets | Plaintext persistence of otherwise valid secrets | CVE-2025-66454 |
| Sensitive Data Exposure | Documented disclosure/storage/output mechanism without a more specific listed primary flaw | SQL/path/authentication failures whose consequence is disclosure | CVE-2025-47274 (plaintext runconfigs), CVE-2025-34072 (link unfurling) |
| Denial of Service | Availability failure is established but no other listed primary mechanism applies; record the specific mechanism in reasoning | RCE; classify regex cases here only with regex detail retained | CVE-2025-53365, CVE-2025-53366 (uncaught exceptions) |
| Insecure Transport | Required encryption/HTTPS/WSS is not enforced, allowing cleartext communication or credential transmission | Destination abuse without a transport-security defect is SSRF; valid TLS to the wrong credential recipient is peer binding | CVE-2026-101057, CVE-2026-108716 |
| Type Confusion | Incorrect conversion changes the type and security-relevant meaning of an otherwise accepted value | Shell/language injection; generic invalid input without type reinterpretation | CVE-2026-104634 (JSON false/null converted to truthy strings) |
| Origin or Host Validation Failure | Missing/wrong Origin, CORS, Host or trusted-proxy locality checks enable cross-origin access, spoofed local origin or attacker-derived URLs | Explicit DNS rebinding retains its own type; credential-to-recipient binding has its own type | CVE-2026-102878, CVE-2026-109332, CVE-2026-111385 |
| Prototype Pollution | Attacker-controlled property access/assignment modifies shared object prototypes | Ordinary language evaluation without shared-prototype modification; generic authorization bypass as impact | CVE-2026-110842 |
| Prompt Injection | Attacker-controlled retrieved/tool/context data is interpreted as instructions that redirect an AI agent | Shell/code syntax injection; prompt injection mentioned only as delivery for an independently established tool implementation flaw | CVE-2026-13341, CVE-2026-18875 |
| CSRF | Attacker induces a victim browser to exercise ambient authenticated authority without request-intent verification | Reading across origins alone; OAuth transaction/callback mix-up uses Session or Peer Binding Failure | CVE-2026-15988 |
| Configuration Injection | Untrusted data escapes its intended configuration value and introduces new assignments/directives | Intentional full executable configuration accepted without trust; ordinary permission bypass on allowed configuration fields | CVE-2026-27203 (newlines create additional .env assignments) |
| HTTP Request Injection | Untrusted values alter outbound HTTP path/query/header structure, adding unintended request fields | SSRF destination selection, demonstrated path traversal or shell/code execution should take their more specific mechanism | CVE-2026-29791 |
| Parser Interpretation Mismatch | Different parser interpretations or nonconforming acceptance of protocol field syntax create inspection/implementation inconsistencies | Type conversion changes value type; a demonstrated approval bypass retains the approval primary type | CVE-2026-27896 (case-insensitive JSON field matching) |
| Content Filter Bypass | An explicitly configured content-scanning/redaction/deny filter misses content due to structural inspection coverage | Account/operation permissions use Authorization; no assumption that a prompt attack succeeded merely because a filter can be bypassed | CVE-2026-11918 (nested payloads bypass top-level-only scanning) |
| Non-SQL Query Injection | Untrusted values alter a generated non-SQL query expression, including Cypher, KQL or GraphQL | SQL retains SQL Injection; intentionally accepted queries with broken read-only policy use Authorization; general-purpose language eval uses Code Injection | CVE-2026-32247, CVE-2026-33980; secondary in CVE-2026-34884 |
| Open Redirect | An attacker-controlled destination or URL interpretation causes browser redirection to an unintended external site | Server-side fetch is SSRF; token/callback recipient mismatch is Session or Peer Binding Failure; no token theft is required | CVE-2026-42230, CVE-2026-44427 |
| Replay Protection Failure | A credential, nonce or authorization artifact intended for one use is accepted repeatedly, including concurrent redemption | Wrong resource/peer binding retains its binding category; missing client-secret verification is Authentication; ordinary repeated use of a reusable bearer token is not replay failure | CVE-2026-53518 (non-atomic authorization-code redemption) |
| Log Injection | Unneutralized record delimiters or terminal controls let input forge, hide or visually alter log entries | Prompt Injection requires agent interpretation; operator social engineering is a possible consequence, not established code execution | CVE-2026-6494 |
| Cache Poisoning | Incorrect cache identity or validation lets an attacker prime a response served for a different request | Parser mismatch alone need not involve a cache; user/session context failures retain binding as primary when that is the demonstrated mechanism | CVE-2026-73846 |
| Unsafe Deserialization | Decoding untrusted serialized objects admits unsafe types or executable object behavior | General source-language evaluation is Code Injection; Type Confusion requires value-type reinterpretation rather than unsafe object reconstruction | CVE-2026-76404 |
| Schema Enforcement Failure | An advertised structured argument schema is accepted but its declared constraints are silently not enforced before dispatch | Content scanning/redaction is Content Filter Bypass; no downstream execution or privilege impact is inferred from a schema violation alone | CVE-2026-88257 |
| Code Execution (Mechanism Unspecified) | Code execution established, but evidence insufficient to choose a mechanism above | Guessing injection from CWE or impact alone | CVE-2025-53928; CVE-2025-65719 moved to Command Injection after primary-source follow-up |

The last category is an explicit impact fallback, not a claim that its mechanism was identified. `Denial of Service` and `Sensitive Data Exposure` also require a mechanism explanation where available. There is no catch-all `Other`: a genuinely unsupported new mechanism remains blank with a backend reason until the vocabulary is deliberately versioned.

## Root cause categories

Root cause answers **which protection or handling failed**, while primary type answers **how the reported vulnerability manifests**. Select multiple categories only when independently supported by the narrative/code. Serialize names with `;` in the following order. Omitted categories are unestablished, never false. A populated root cell need not be exhaustive.

| Stable name | Include | Exclude / overlap rule | Reviewed example |
|---|---|---|---|
| Input Validation | Missing/incorrect escaping, canonicalization, numeric bounds, parsing, type-preserving conversion or input constraints | Do not duplicate a specific authentication, binding, origin or approval check merely because it consumes input; a correctly raised but uncaught validation exception belongs to Exception Handling | CVE-2025-53107, CVE-2025-68144 |
| Authentication | Missing/bypassed verification of caller identity or credentials | Permission checks for a known caller; callback/session binding; mere absence of authentication in a deployment without evidence of a failed gate | CVE-2025-13822, CVE-2025-66454 |
| Authorization | Missing/bypassed permissions, capability or isolation restrictions, including read-only and filesystem confinement | Identity verification; user approval/configuration trust; do not infer it merely from a harmful impact | CVE-2025-5071, CVE-2025-53109, CVE-2025-53372 |
| User Approval and Configuration Trust | Missing trust establishment, complete security disclosure or reapproval before executing configuration | Generic account authentication; ordinary command syntax validation | CVE-2025-54133, CVE-2025-54136, CVE-2025-68433 |
| Session or Peer Binding | Predictability/reuse or missing client, callback, code-verifier, token-audience/resource or peer binding | Do not also add generic Authorization or Protocol/Interaction Boundary Controls for the same binding failure | CVE-2025-4143, CVE-2025-6515, CVE-2025-69196 |
| Protocol/Interaction Boundary Controls | Missing origin/Host/browser-to-localhost, required HTTPS/WSS, or other evidenced transport/interaction checks not covered by session/peer binding | Merely involving MCP, OAuth, an SDK or a network; not an assertion of a specification defect; do not duplicate the same Host/Origin check as Input Validation | CVE-2025-59163, CVE-2025-66416 |
| Exception Handling | Uncaught or incorrectly recovered errors cause loss of service or fail-open security controls | Assuming the rejecting validator itself is defective; resource exhaustion without exception evidence; do not infer fail-open behavior merely from an error | CVE-2025-53365, CVE-2025-53366 |
| Sensitive Data Handling | Unsafe credential defaults, secret persistence, encryption or output/disclosure handling | Generic disclosure as an impact of another flaw; storage access does not automatically establish broken permissions | CVE-2025-47274, CVE-2025-66454, CVE-2025-34072 |
| Resource Limits and Computational Complexity | Missing body/frame/allocation limits or unsafe algorithmic complexity allowing CPU/memory exhaustion | A numeric overflow without resource exhaustion is Input Validation; uncaught exceptions alone are Exception Handling; do not duplicate the same size limit as Input Validation | CVE-2026-0621, CVE-2026-108395, CVE-2026-108714, CVE-2026-109527 |
| State and Transaction Management | Failed operations leave inconsistent persistent state, missing rollback or unsafe ordering across stores; stale persisted resource identities are reused without lifecycle checks; missing atomic consumption of one-use state or expiry cleanup | Generic access permission or name/path validation; do not infer rollback failure merely from an exception | CVE-2026-115478 (SQLite changes precede fallible note writes); CVE-2026-111451 (stale process-ID reuse) |
| Instruction and Data Separation | Untrusted retrieved or tool-provided content is promoted into agent instructions, steering tool use | Merely mentioning prompt injection as delivery for path/command/SSRF defects; this label does not claim a sanitizer guarantees prompt safety | CVE-2026-13341, CVE-2026-18875 |

Examples of legitimate multiple roots: a path validator defeats an explicit directory capability (`Input Validation;Authorization`); a known default JWT secret breaks credential handling and identity verification (`Authentication;Sensitive Data Handling`). For CVE-2025-53366, record `Exception Handling`, not Input Validation merely because a validation error was raised. For CVE-2025-53928, root cause remains blank because the available execution report does not identify the failed protection. The follow-up for CVE-2025-65719 establishes Input Validation through namespace interpolation into a shell template. A browser-to-localhost attack alone does not prove a particular origin, authentication, approval or input-control defect.


## Component and uncertainty

The single component label describes the **affected code function**, not the whole product, attacker, eventual impact, repository/package name, or downstream service. v2.6 retains three MCP roles and adds four positively defined ecosystem functions. These are an operational coding scheme, not a claim that all seven are MCP protocol roles. Source/runtime packaging does not override the affected function.

| Stable name | Include | Exclude / boundary |
|---|---|---|
| `server` | Application implementations of provided MCP tools, resources, prompts, transport, and their dedicated authorization; tool implementation code and direct alternate invocation routes for those same tools | Generic REST/data APIs, catalogue/admin APIs, and a generated server's generator |
| `client` | Active MCP consumption: discovery, connection/test, transport/OAuth, agent tool selection/approval, launch and activation of upstream servers; launch-bound configuration/credentials | Pure stored-configuration CRUD, generic LLM/A2A clients, external IDE configuration installers, whole-product attribution |
| `sdk` | Reusable MCP transport/protocol/session/authentication/schema/dispatch implementation or reusable runtime provider/consumer framework code | An `sdk` directory alone; agent SDKs consuming MCP; generic workflow/payment libraries; separate spec import/code-generation/install stages |
| `management-plane` | Catalogue publication/namespace checks; administrative configuration, identities, credentials and permissions; health/metrics/log APIs; prompt/workflow definition CRUD | Actual protocol token verification/authorization, active connector launch/test, user-facing rendering, ordinary application-data operations |
| `user-interface` | Application chat/Markdown/diagram/template/catalogue/admin presentation code and browser/desktop rendering sinks | MCP content ingress or downstream launch capability does not make this client/server; dedicated protocol OAuth processing remains attributed to its protocol implementation |
| `development-tool` | Static repository scanners; code/spec-to-tool generation and import; setup utilities that write configuration for another host or invoke installation CLIs | A running consumer that installs/activates upstream servers as part of its own connection lifecycle; an MCP tool that happens to run a scanner/compiler |
| `supporting-runtime` | Positively identified non-MCP operational REST bridges, LLM/A2A/inference/workflow/data services, backend-service OAuth helpers, generic computation/HTTP/policy/payment libraries | Not an `Other` bucket: a known operational function outside the above classes is required; a named provided MCP tool remains server; reusable MCP implementation remains sdk |

### Assignment procedure and difficult boundaries

1. Locate the affected function/module and the primary failure from the saved evidence. A product name alone never selects a category. If the route/function cannot be located sufficiently, keep the component blank.
2. Separate application presentation, administrative controls, and generation/setup from protocol operation. Use the specific positive category above. For example, registry HTTP publication is management-plane; its catalogue HTML renderer is user-interface; neither is server merely because a browser connects to it.
3. For operational MCP paths, distinguish reusable implementation (`sdk`) from an application provider (`server`) or consumer (`client`). Backend functions directly implementing a named MCP tool inherit that provider role; merely being usable by a custom downstream caller does not suffice. An alternate HTTP invocation endpoint explicitly dispatching the same MCP tools is still provider implementation.
4. A documented operational path using another protocol, or a generic shared runtime library, is supporting-runtime. Do not require inventing an MCP registration just to avoid a blank. A generic REST API is not automatically supporting-runtime: credential/configuration/diagnostic administration uses management-plane.
5. When the evidence spans multiple functions, follow the location of the primary reported defect. Preserve the secondary paths in the reason. Do not multiply counts or silently assign the role of a more dramatic downstream consequence.

Examples: FastMCP's protocol OAuth callback remains sdk, while `fastmcp install cursor` is development-tool. An application OAuth client consuming MCP remains client; a dbt/Atlassian backend-authentication helper is supporting-runtime. MCP Appium's tool directly constructs an MCP UI resource, so its provider-side generation flaw remains server; an independent chat/diagram renderer is user-interface. Workflow-definition CRUD is management-plane, while the REST workflow runner is supporting-runtime. OpenAPI import/tool-definition generators are development-tool even when invoked during initialization; an SDK's request builder executing an already-defined MCP tool remains sdk. Stored secret catalogue APIs are management-plane; credentials bound directly to an active connector's launch/transport remain client/server as evidenced.