CVE-2025-34072: anthropic slack mcp server Improper Input Validation

Vulnerability summary

CVE-2025-34072 is a critical (CVSS 9.3) Improper Input Validation vulnerability in anthropic slack mcp server. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 36.1% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 02-07-2025
   PublishedVulnerability first disclosed.
2. 02-07-2025
   Last modifiedVulnerability information updated.

Description

A data exfiltration vulnerability exists in Anthropic’s deprecated Slack Model Context Protocol (MCP) Server via automatic link unfurling. When an AI agent using the Slack MCP Server processes untrusted data, it can be manipulated to generate messages containing attacker-crafted hyperlinks embedding sensitive data. Slack’s link preview bots (e.g., Slack-LinkExpanding, Slackbot, Slack-ImgProxy) will then issue outbound requests to the attacker-controlled URL, resulting in zero-click exfiltration of private data.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
• CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.