mcp-router CVE-2026-81094

Exploitation requires that a pre-0.6.3 mcp-router CLI was started with the serve command in its default mode (host not overridden, --token not supplied) AND that the host running it is network-reachable by the attacker on the fixed port 3283. Under those conditions there are no further prerequisites: no authentication (PR:N), no user interaction (UI:N), and default configuration is itself the vulnerable state. The main limiting factors are network exposure (a serve instance only reachable via loopback or blocked by a firewall is not exploitable) and operator behavior (supplying --token on older versions restores authentication and removes the exposure).

The signals align toward high priority: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H) describes remote, low-complexity, unauthenticated exploitation against a default configuration, and the fix confirms the insecure default was real (host defaulted to 0.0.0.0, token optional). The high confidentiality and integrity impact reflects that an attacker gains full unauthenticated use of every MCP server behind the aggregator. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or automated exploitation yet - the 9.3 rests on the vector and the trivial reachability of the flaw rather than on observed attacks. The practical limiter is exposure: the impact only materializes when the host running serve is reachable by an attacker (untrusted LAN, cloud instance with an open port, or port-forwarded), so a developer running it on a firewalled workstation is far less exposed than a shared or internet-facing host. Given how low the exploitation bar is once the port is reachable, any operator running a pre-0.6.3 serve on a multi-user or network-exposed host should treat upgrading as urgent.

An attacker on the same LAN, cloud VPC, or the internet scans for the fixed mcp-router port 3283, finds a bridge that a developer started with a default mcpr-cli serve python my-mcp-server.py (no token), and connects an MCP client to it without any credential. They then drive the downstream MCP servers directly - reading files, calling tools, or invoking integrations exposed by those servers. No public POC is identified, but exploitation requires only a standard MCP client and network reachability.