German web host Mittwald says an attacker got into 56 customer projects through its MCP server

German web host Mittwald said on November 7, 2026 that an attacker broke in through its MCP server, the interface customers used to connect AI assistants to mStudio, Mittwald's control panel for hosting projects. The post is by Robert Meyer, who the page identifies as Mittwald's founder and managing director. Mittwald says that on November 6 it forensically reviewed 56 compromised projects and the MCP server.

The post says the attacker first tested a flaw in the MCP server on the evening of October 21, then from October 23 used the platform as an ordinary user, registering test accounts, using extensions and trying simple injection attempts. On October 27 at 14:58 the attacker registered another account and at 15:03, five minutes later, used it to exploit the flaw found in the MCP server. Mittwald says its logs show the attacker moving through its systems extremely fast, sometimes only seconds between steps that would take a human much longer, which it says points to the use of AI tools. It also says the attacker hid those accesses behind distractions that Mittwald looked at first. Mittwald says it treats all data from October 27 onward as compromised. The post prints those clock times and does not name a timezone.

What the attacker could reach

Mittwald's notice template for agencies says the MCP server is the interface hosting customers used to connect their management panel to AI assistants. It says access tokens of users of that interface were read, and that a token gave access to the projects that user managed at Mittwald with the same rights as the user. It says passwords were not read, and that unauthorized access was possible from October 27 until the tokens were blocked on November 4. The template lists the website's files and code, its database, credentials for third-party services stored in the project, and email inboxes managed through the project as data that could be affected, and says Mittwald is checking each project individually. It says that, according to Mittwald, there is so far no indication that data was published.

Mittwald's FAQ, which the template calls Mittwald's binding page for this incident, says what was read were access credentials in the form of tokens, and in the password answer it calls them session tokens. It says no passwords were read, and that every one of those tokens was revoked and no longer works. It says a token allowed access to that user's mStudio with that user's rights, including projects the user could access, and that Mittwald is checking each affected project. The FAQ says the flaw was in Mittwald's MCP server. Mittwald took that server offline, closed the flaw, and says the server stays offline while it decides whether to offer the interface again. It says the Mittwald CLI can be used instead. It says you are affected only if you used the MCP server, that affected customers receive a personal email, and that if you never set the MCP server up and received no email, you are not affected on the current findings. It says any use of the MCP server from October 27 on counts as potentially compromised.

The FAQ's latest update is dated November 7, 2026, 10:56 CET. It matches the blog: mStudio can be used again, SSH access was turned back on at the same time, websites Mittwald blocked as a precaution stay blocked for now, the separate Kundencenter and the websites managed there were never affected, and customers can add a passkey to mStudio. A question further down the same FAQ still says the central SSH lock remains and that Mittwald cannot yet name a time when mStudio will return. Those answers disagree with the November 7, 10:56 CET update and with the blog. This item follows the dated November 7 statements.

What Mittwald did

The blog says that on the morning of November 4 Mittwald noticed unusual behavior, blocked the attacker's first account at 11:11, and at 12:53 had a sense of the scope and set its status page to investigation. It took parts of its systems offline, identified the MCP server as the way in and switched it off. That evening mStudio was online again, and web projects had stayed reachable the whole time. On November 5, shortly after midnight, it blocked projects where it found traces of the attacker and paused new account registration. During the day it disabled mStudio logins and SSH access to customer projects. Outside forensic experts kept analyzing the attack, and Mittwald says it informed the responsible authorities. On November 6, after repeated scans, it says it found no further compromised projects and that it cannot currently show attacker activity on its systems. mStudio was usable again overnight. On November 7, mStudio and SSH access came back. Sites blocked as a precaution stay blocked for now, and Mittwald says it will email customers if more steps are needed. It says a fuller account will follow once analysis and restoration are finished.

The FAQ's November 5, 2026 updates, labeled CET, say Mittwald also turned off its extensions and orders during the investigation. The November 7 update does not say whether those are back. The FAQ says Mittwald precautionarily blocked some API keys in the first response. If it restores a project from a backup, it says it will discuss with the customer which changes since October 27 to keep.

For people who used the MCP server, the FAQ says to change the mStudio password, turn on two-factor authentication, check API keys, project tokens and SSH keys in the projects and delete unknown entries, watch for SSH users you did not create, renew third-party credentials stored in the projects (it names databases, mail and external APIs), and tell the project's users. The FAQ also says Mittwald recommends two-factor authentication even for customers who never used the MCP server. The November 7 update says a passkey can now be added to mStudio.

Our advice, not Mittwald's: where a host lets an AI assistant connect with a scoped or read-only token, use that instead of a token that can do everything you can do, and revoke tokens you are not using.