CVE-2025-34072 CRITICAL

CVE-2025-34072: Anthropic Slack MCP Server Data Exfiltration via Link Unfurling

Vendor Anthropic
Product Slack MCP Server
Weakness CWE-200 · Info exposure
Published July 2, 2025
Last update July 2, 2025
View on NVD All CVEs

CVSS base score

9.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H

What the vulnerability does

01Description

A data exfiltration vulnerability exists in Anthropic’s deprecated Slack Model Context Protocol (MCP) Server via automatic link unfurling. When an AI agent using the Slack MCP Server processes untrusted data, it can be manipulated to generate messages containing attacker-crafted hyperlinks embedding sensitive data. Slack’s link preview bots (e.g., Slack-LinkExpanding, Slackbot, Slack-ImgProxy) will then issue outbound requests to the attacker-controlled URL, resulting in zero-click exfiltration of private data.

Key dates

02Disclosure timeline

July 2, 2025 CVE published
July 2, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-42873 WeGIA: Error Handling Upload DocDependente CVE-2021-21336 Exposure of Sensitive Information to an Unauthorized Actor in Products.PluggableAuthService ZODBRoleManager CVE-2024-25591 WordPress WP Editor plugin <=1.2.7 - Sensitive Data Exposure vulnerability CVE-2024-35165 WordPress Gutenify plugin <= 1.4.0 - Sensitive Data Exposure via API vulnerability CVE-2026-32094 Shescape escape() leaves bracket glob expansion active on Bash, BusyBox, and Dash