What is the CVSS score of CVE-2026-55605?

CVE-2026-55605 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.4%.

Is there a public PoC exploit available for CVE-2026-55605?

Yes, a public proof-of-concept exploit is available for CVE-2026-55605. Prioritise patching immediately. EPSS: 0.4%.

Is there a patch available for CVE-2026-55605?

Yes, a patch is available for CVE-2026-55605. Update the affected software to the latest version immediately.

DeepSeek MCP Server CVE-2026-55605

EUVD-2026-42717 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-07-09 GitHub_M

GHSA-72f3-6w86-7rv3

Authentication Bypass Docker Deepseek Mcp Server

5.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

7.3 HIGH

Network-exposed unauthenticated endpoint; C:L and I:L reflect confirmed tool enumeration and API key consumption; A:L for operator quota exhaustion.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Patch available

Jul 09, 2026 - 23:02 EUVD

Analysis Generated

Jul 09, 2026 - 22:22 vuln.today

DescriptionCVE.org

DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.8.0, the self-hosted HTTP transport of @arikusi/deepseek-mcp-server exposes POST /mcp without any authentication: createMcpExpressApp is called without an authProvider and no middleware guards the route, so any network-reachable client can issue an unauthenticated initialize request and obtain a valid MCP session identifier. In reproduced testing against commit 5e1302171e99, an unauthenticated client was able to initialize a session, enumerate tools, and invoke the local deepseek_sessions tool with no credentials. The same unauthenticated session also exposes deepseek_chat, whose handler uses the server-side DEEPSEEK_API_KEY when self-hosted deployments configure one. This issue applies to self-hosted HTTP mode, not the separately documented hosted BYOK endpoint in README.md, which expects an Authorization: Bearer ... header. Upstream self-hosted container assets enable HTTP mode by default (Dockerfile) and publish port 3000 (docker-compose.yml). Version 1.8.0 contains a patch for this issue.

AnalysisAI

Unauthenticated access to the self-hosted HTTP transport of DeepSeek MCP Server (versions 1.4.2-1.7.x) allows any network-reachable client to initialize a valid MCP session, enumerate server tools, and invoke them without credentials - including deepseek_chat, which silently consumes the server operator's DEEPSEEK_API_KEY. Default Docker deployments expose port 3000 in HTTP mode out of the box, maximizing the attack surface for any container running on a network-accessible host. No public exploit has been identified at time of analysis, though the GitHub advisory references reproduced testing confirming the full bypass against commit 5e1302171e99.

Technical ContextAI

The affected package (@arikusi/deepseek-mcp-server, CPE: cpe:2.3:a:arikusi:deepseek-mcp-server:*:*:*:*:*:*:*:*) implements a Model Context Protocol (MCP) server over Express HTTP. The root cause is CWE-306 (Missing Authentication for Critical Function): createMcpExpressApp is instantiated without an authProvider argument, and no middleware intercepts or guards the POST /mcp route. The self-hosted HTTP transport is architecturally distinct from the hosted BYOK endpoint documented in README.md, which correctly enforces Authorization: Bearer headers. Upstream container assets (Dockerfile and docker-compose.yml) default to HTTP mode and publish port 3000, meaning any containerized deployment following official instructions is exposed without additional network-level controls.

RemediationAI

Upgrade to version 1.8.0, released 2026-06-14, which patches this issue by enforcing authentication on the POST /mcp route. The patched release is available at https://github.com/arikusi/deepseek-mcp-server/releases/tag/v1.8.0 and the changelog entry is at https://github.com/arikusi/deepseek-mcp-server/blob/main/CHANGELOG.md#180---2026-06-14. Until patching is possible, restrict network access to port 3000 using host firewall rules or Docker network policies to allow only trusted source IPs - note this does not fix the underlying flaw but limits reachability. If self-hosted HTTP mode is not operationally required, disabling it eliminates the attack surface entirely. Any operator whose server was network-reachable to untrusted clients before patching should rotate the DEEPSEEK_API_KEY immediately, as unauthenticated sessions could have consumed API quota or accessed model outputs.