CVE-2026-62264

PDF Reader MCP is a Model Context Protocol server for reading PDF documents. In versions 2.2.0 and later prior to 3.0.1, when `MCP_TRANSPORT=http` enables the opt-in HTTP server, `@sylphx/pdf-reader-mcp` reads `MCP_API_KEY` and logs that `X-API-Key` authentication is enabled but never validates the `X-API-Key` header on incoming requests. The `/mcp` endpoint consequently accepts unauthenticated clients. With the default bind address of `0.0.0.0`, any client able to reach the port can invoke every PDF tool and read any PDF the server process can open on the host, despite the misleading authentication-enabled startup log. URL-based sources additionally permit limited server-side request forgery; private and loopback destinations are blocked by default unless `--allow-private-ips` is set. The default `stdio` transport is unaffected. This issue is fixed in version 3.0.1.

• CWE-200
• CWE-287
• CWE-306

• https://github.com/SylphxAI/anymd/commit/4c35f72862d729301e3912ab8c8317d2828cf4c2
• https://github.com/SylphxAI/anymd/pull/332
• https://github.com/SylphxAI/anymd/security/advisories/GHSA-q344-5v34-gm84
• https://github.com/SylphxAI/anymd/tree/v3.0.1

Published

Oct 30, 2026

Last Modified

Oct 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-62252Homer is open source telecom observability software. Prior t…9.8
• CVE-2026-62253Homer is open source telecom observability software. Prior t…9.8
• CVE-2026-62254LibreDWG is a free C library to read and write DWG files. Pr…5.5
• CVE-2026-6226The Frontend Admin by DynamiApps plugin for WordPress is vul…8.8
• CVE-2026-62262Piwigo is a full featured open source photo gallery applicat…9.1
• CVE-2026-62263Open Access Management (OpenAM) is an access management solu…9.2
• CVE-2026-6227The BackWPup plugin for WordPress is vulnerable to Local Fil…7.2
• CVE-2026-62277LubeLogger is a self-hosted, open-source, web-based vehicle …6.5
• CVE-2026-62278LubeLogger is a self-hosted, open-source, web-based vehicle …8.1
• CVE-2026-62279LubeLogger is a self-hosted, open-source, web-based vehicle …7.1
• CVE-2026-6228The Frontend Admin by DynamiApps plugin for WordPress is vul…8.8
• CVE-2026-62280Open Access Management (OpenAM) is an access management solu…6.1