Mcp Router
Monthly
Missing authentication on the mcp-router CLI's MCP aggregator exposes every backend MCP server it fronts to any network-reachable attacker. In releases before 0.6.3, the `serve` command bound to the all-interfaces address (0.0.0.0) on fixed port 3283 by default and only enforced a token when the operator explicitly passed the `--token` flag, so a normal `mcpr-cli serve ...` invocation published the aggregator unauthenticated to the entire network. Reported by VulnCheck with a CVSS 4.0 base score of 9.3; no public exploit code or active-exploitation reporting is identified at time of analysis.
Missing authentication on the mcp-router CLI's MCP aggregator exposes every backend MCP server it fronts to any network-reachable attacker. In releases before 0.6.3, the `serve` command bound to the all-interfaces address (0.0.0.0) on fixed port 3283 by default and only enforced a token when the operator explicitly passed the `--token` flag, so a normal `mcpr-cli serve ...` invocation published the aggregator unauthenticated to the entire network. Reported by VulnCheck with a CVSS 4.0 base score of 9.3; no public exploit code or active-exploitation reporting is identified at time of analysis.