EUVD-2026-67022
GHSA-g448-x63h-m2m3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Default all-interfaces bind with no token gives remote, low-complexity, unauthenticated access (AV:N/AC:L/PR:N/UI:N); full read/write use of fronted MCP servers yields C:H/I:H, no availability impact (A:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
The mcp-router CLI served its MCP aggregator on every interface and enforced authentication only when the operator asked for it. The serve command in apps/cli/src/commands/serve.ts defaulted its host to the all-interfaces address on a fixed port, and required a token only when the corresponding flag was supplied, so a default invocation exposed the aggregator, and every MCP server it fronted, to anyone able to reach the port. Release 0.6.3 defaults the host to the loopback address and refuses to start without a token whenever the host it is given is not a loopback address; no earlier release carries either check.
AnalysisAI
Missing authentication on the mcp-router CLI's MCP aggregator exposes every backend MCP server it fronts to any network-reachable attacker. In releases before 0.6.3, the serve command bound to the all-interfaces address (0.0.0.0) on fixed port 3283 by default and only enforced a token when the operator explicitly passed the --token flag, so a normal mcpr-cli serve ... …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a pre-0.6.3 mcp-router CLI was started with the `serve` command in its default mode (host not overridden, `--token` not supplied) AND that the host running it is network-reachable by the attacker on the fixed port 3283. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals align toward high priority: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H) describes remote, low-complexity, unauthenticated exploitation against a default configuration, and the fix confirms the insecure default was real (host defaulted to 0.0.0.0, token optional). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker on the same LAN, cloud VPC, or the internet scans for the fixed mcp-router port 3283, finds a bridge that a developer started with a default `mcpr-cli serve python my-mcp-server.py` (no token), and connects an MCP client to it without any credential. They then drive the downstream MCP servers directly - reading files, calling tools, or invoking integrations exposed by those servers. … |
| Remediation | Upgrade to mcp-router 0.6.3 or later, which defaults `serve` to the loopback address (127.0.0.1) and refuses to start on a non-loopback host unless `--token` is supplied (patch commit 4c4642cfd274097ec8b33ecd3047390829c79d35). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all deployments of mcp-router CLI across your infrastructure to identify exposed instances and document current versions in use. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today