Live › vulnerability › CVE-2026-62264
When run in HTTP mode, the MCP server logs that API key auth is enabled but never checks the X-API-Key header on the /mcp endpoint. Anyone who can reach the port can call every PDF tool and read any PDF the server process can open.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:39 UTC. All times on this page are UTC.
Only deployments running the HTTP transport (MCP_TRANSPORT=http) are exposed; the default stdio transport is not affected. Servers bound to all interfaces, which is the default bind, are reachable by any client that can reach the port, so they are the priority to look at. Teams that run it over stdio on a developer machine can skip this.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| @sylphx/pdf-reader-mcp | npm | >= 2.2.0, < 3.0.1 | 3.0.1 |
npm ls @sylphx/pdf-reader-mcp and see whether it is >= 2.2.0 and < 3.0.1.MCP_TRANSPORT=http and what is set to; the default bind is .MCP_HTTP_HOST0.0.0.0@sylphx/pdf-reader-mcp fixed in 3.0.1; affected range is >= 2.2.0, < 3.0.1.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
When @sylphx/pdf-reader-mcp is run as an HTTP server (MCP_TRANSPORT=http), it reads the MCP_API_KEY environment variable and logs API key authentication enabled (X-API-Key header) at startup, but it never validated the X-API-Key header on incoming requests. The key was read into a variable and never enforced on the request path.
As a result, the /mcp endpoint accepted unauthenticated requests. Combined with the default bind address of 0.0.0.0 (all interfaces), any client able to reach the port could invoke every PDF tool and read the contents of any PDF the server process could open anywhere on the host. URL-based sources also enable limited SSRF (private/loopback addresses are blocked by default unless --allow-private-ips is set).
The misleading startup log made the exposure silent: an operator who set MCP_API_KEY reasonably believed the server was protected when it was not.
This affects only the opt-in HTTP transport; the default stdio transport is unaffected.
Fixed in @sylphx/[email protected]. The fix enforces the X-API-Key header with a constant-time comparison (rejecting missing/mismatched keys with HTTP 401), changes the default bind host to 127.0.0.1 (loopback), and emits a startup warning when binding a non-loopback host without an API key.
For deployments that cannot upgrade immediately:
MCP_HTTP_HOST=127.0.0.1.stdio transport instead of HTTP.--allow-dir / MCP_PDF_ALLOWED_DIRS.Reported privately by novice-22 via responsible disclosure.
This page as .md · .json · in your agent: get_signal("CVE-2026-62264")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.