Chainstack Details Production Breach Through Unauthenticated MCP Server

Chainstack’s Nov. 10 security update described how an attacker used a Grafana test instance with its default administrator password and an unauthenticated MCP server to reach production systems.

The attack began at the Grafana test instance. The attacker entered Chainstack’s internal network, then used an MCP tool server with Kubernetes cluster-admin privileges to extend access into production. Chainstack linked the route to a default password, missing authentication on the server and excessive Kubernetes privileges.

Model Context Protocol (MCP) is a standard that lets AI agents connect to external tools and data. Chainstack’s update also identified ARTEX, an AI attack framework, as part of the intrusion.

The attacker accessed a database containing customer names, email addresses and password hashes. Some production-system credentials were also obtained.

Chainstack asked all customers to change their passwords, rotate node credentials and regenerate API keys.