CVE-2026-81094

The mcp-router CLI served its MCP aggregator on every interface and enforced authentication only when the operator asked for it. The serve command in apps/cli/src/commands/serve.ts defaulted its host to the all-interfaces address on a fixed port, and required a token only when the corresponding flag was supplied, so a default invocation exposed the aggregator, and every MCP server it fronted, to anyone able to reach the port. Release 0.6.3 defaults the host to the loopback address and refuses to start without a token whenever the host it is given is not a loopback address; no earlier release carries either check.

• CWE-306

• https://github.com/mcp-router/mcp-router
• https://github.com/mcp-router/mcp-router/blob/v0.6.3/apps/cli/src/commands/serve.ts#L105
• https://github.com/mcp-router/mcp-router/commit/4c4642cfd274097ec8b33ecd3047390829c79d35
• https://github.com/mcp-router/mcp-router/security/advisories/GHSA-rx55-5c7h-r56r
• https://www.vulncheck.com/advisories/mcp-router-cli-before-0.6.3-binds-the-mcp-aggregator-to-all-interfaces-without-requiring-authentication

Published

Aug 27, 2026

Last Modified

Aug 27, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8108The installation of Fuji Tellus adds a driver to the kernel …7.8
• CVE-2026-8109An exposed dangerous method on the Core Server of Ivanti End…6.5
• CVE-2026-81090The Gpx2Graphics WordPress plugin through 0.3 does not perfo…7.2
• CVE-2026-81091The proxy middleware in mcp-use's inspector forwards request…8.6
• CVE-2026-81092mcp-go accepted requests on its HTTP transports without chec…6.8
• CVE-2026-81093The get-html-skeleton tool fetched a URL the caller supplied…8.6
• CVE-2026-81095pg-aiguide started its MCP HTTP transport without enabling t…6.8
• CVE-2026-81096ToolUniverse ran caller-supplied Python inside a sandbox tha…10
• CVE-2026-81097The execute_ruby tool is documented as a read-only Ruby sand…8.4
• CVE-2026-81098The Telnyx MCP server exposed its HTTP transport on every in…9.1
• CVE-2026-81099tiger-slack started its MCP HTTP transport without enabling …6.8
• CVE-2026-8110Incorrect permissions assignment in the agent of Ivanti Endp…7.8