{"id":"CVE-2026-62264","kind":"vulnerability","aliases":["CVE-2026-62264","GHSA-q344-5v34-gm84"],"related":[],"title":"@sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY","description":"### Impact\n\nWhen `@sylphx/pdf-reader-mcp` is run as an HTTP server (`MCP_TRANSPORT=http`), it reads the `MCP_API_KEY` environment variable and logs `API key authentication enabled (X-API-Key header)` at startup, but it never validated the `X-API-Key` header on incoming requests. The key was read into a variable and never enforced on the request path.\n\nAs a result, the `/mcp` endpoint accepted **unauthenticated** requests. Combined with the default bind address of `0.0.0.0` (all interfaces), any client able to reach the port could invoke every PDF tool and read the contents of any PDF the server process could open anywhere on the host. URL-based sources also enable limited SSRF (private/loopback addresses are blocked by default unless `--allow-private-ips` is set).\n\nThe misleading startup log made the exposure silent: an operator who set `MCP_API_KEY` reasonably believed the server was protected when it was not.\n\nThis affects only the opt-in HTTP transport; the default `stdio` transport is unaffected.\n\n### Patches\n\nFixed in `@sylphx/pdf-reader-mcp@3.0.1`. The fix enforces the `X-API-Key` header with a constant-time comparison (rejecting missing/mismatched keys with HTTP 401), changes the default bind host to `127.0.0.1` (loopback), and emits a startup warning when binding a non-loopback host without an API key.\n\n### Workarounds\n\nFor deployments that cannot upgrade immediately:\n\n- Bind to loopback only: `MCP_HTTP_HOST=127.0.0.1`.\n- Place a reverse proxy in front that enforces authentication.\n- Use the default `stdio` transport instead of HTTP.\n- Restrict filesystem reach with `--allow-dir` / `MCP_PDF_ALLOWED_DIRS`.\n\nReported privately by **novice-22** via responsible disclosure.","summary":"When run in HTTP mode, the MCP server logs that API key auth is enabled but never checks the X-API-Key header on the /mcp endpoint. Anyone who can reach the port can call every PDF tool and read any PDF the server process can open.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@sylphx/pdf-reader-mcp","fixed":["3.0.1"],"affected":">= 2.2.0, < 3.0.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["ai-tooling","cwe-200","cwe-287","cwe-306","mcp","node","npm","pdf","self-hosted"],"not_affected_if":["behind-auth-proxy","loopback-bind","stdio-transport"],"how_to_check":"- Check the installed version with `npm ls @sylphx/pdf-reader-mcp` and see whether it is `>= 2.2.0` and `< 3.0.1`.\n- Check whether the server runs with `MCP_TRANSPORT=http` and what `MCP_HTTP_HOST` is set to; the default bind is `0.0.0.0`.\n- Confirm whether the port is reachable from other machines on the network.","fix":"- `@sylphx/pdf-reader-mcp` fixed in `3.0.1`; affected range is `>= 2.2.0`, `< 3.0.1`.","status":"open","published_at":"2026-10-29T16:34:35+00:00","first_seen_at":"2026-10-29T16:39:03+00:00","triaged_at":"2026-10-29T16:39:43+00:00","updated_at":"2026-10-29T16:39:43+00:00","category":"ai-tooling","confidence":0.85,"triage":{"at":"2026-10-29T16:39:43Z","model":"claude-haiku-5-5","output":{"fix":"- `@sylphx/pdf-reader-mcp` fixed in `3.0.1`; affected range is `>= 2.2.0`, `< 3.0.1`.","reach":"network","title":"PDF Reader MCP: HTTP transport skips the API key check, exposing PDFs","impact":"high","summary":"When run in HTTP mode, the MCP server logs that API key auth is enabled but never checks the X-API-Key header on the /mcp endpoint. Anyone who can reach the port can call every PDF tool and read any PDF the server process can open.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["mcp","npm","node","pdf","self-hosted"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"Remote clients read arbitrary PDFs on the host without credentials","analyst_note":"Check the GHSA-q344-5v34-gm84 advisory for the exact fixed-version statement and whether any exploitation has been reported.","how_to_check":"- Check the installed version with `npm ls @sylphx/pdf-reader-mcp` and see whether it is `>= 2.2.0` and `< 3.0.1`.\n- Check whether the server runs with `MCP_TRANSPORT=http` and what `MCP_HTTP_HOST` is set to; the default bind is `0.0.0.0`.\n- Confirm whether the port is reachable from other machines on the network.","plain_action":"","needs_analyst":true,"not_affected_if":["stdio-transport","loopback-bind","behind-auth-proxy"],"who_is_affected":"Only deployments running the HTTP transport (MCP_TRANSPORT=http) are exposed; the default stdio transport is not affected. Servers bound to all interfaces, which is the default bind, are reachable by any client that can reach the port, so they are the priority to look at. Teams that run it over stdio on a developer machine can skip this.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000834,"input_tokens":4801,"output_tokens":708,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-200':29B '-2026':14A,22A '-22':354C '-287':31B '-306':33B '-62264':15A,23A '/mcp':67B,153C '0.0.0.0':165C '127.0.0.1':289C,321C '3.0.1':261C '401':282C '5v34':19A 'abl':170C 'accept':4A,155C 'address':163C,205C 'affect':243C 'ai':26B 'ai-tool':25B 'allow':212C,344C,348C 'allow-dir':343C 'allow-private-ip':211C 'also':200C 'anyon':69B 'anywher':192C 'api':11A,51B,62B,105C,111C,117C,129C,230C,268C,305C 'auth':53B 'authent':113C,330C 'base':198C 'believ':233C 'bind':162C,286C,297C,314C 'block':207C 'call':76B 'cannot':311C 'chang':283C 'check':58B 'client':169C 'combin':158C 'comparison':276C 'configur':9A 'constant':274C 'constant-tim':273C 'content':183C 'could':175C,190C 'cve':13A,21A 'cwe':28B,30B,32B 'default':161C,209C,252C,285C,333C 'deploy':309C 'despit':7A 'dir':345C,349C 'disclosur':357C 'emit':292C 'enabl':55B,114C,201C 'endpoint':68B,154C 'enforc':144C,264C,329C 'environ':107C 'everi':77B,177C 'exposur':223C 'filesystem':340C 'fix':258C,263C 'front':327C 'ghsa':17A 'ghsa-q344-5v34-gm84':16A 'gm84':20A 'header':64B,119C,131C,270C 'host':40B,195C,287C,302C,320C 'http':2A,44B,96C,100C,249C,281C,319C,338C 'immedi':313C 'impact':89C 'incom':133C 'instead':336C 'interfac':167C 'invok':176C 'ip':214C 'key':12A,52B,63B,106C,112C,118C,130C,136C,231C,269C,279C,306C 'limit':202C 'log':49B,110C,220C 'loopback':290C,301C,316C 'made':221C 'mcp':10A,34B,47B,98C,104C,229C,318C,346C 'mislead':218C 'missing/mismatched':278C 'mode':45B 'never':57B,124C,143C 'node':35B 'non':300C 'non-loopback':299C 'novic':353C 'npm':36B 'open':88B,191C 'oper':226C 'opt':247C 'opt-in':246C 'patch':257C 'path':148C 'pdf':37B,78B,83B,178C,186C,347C 'place':322C 'port':74B,174C 'privat':213C,351C 'private/loopback':204C 'process':86B,189C 'protect':237C 'proxi':325C 'q344':18A 'reach':72B,172C,341C 'read':81B,102C,138C,181C 'reason':232C 'reject':277C 'report':350C 'request':6A,134C,147C,157C 'respons':356C 'restrict':339C 'result':151C 'revers':324C 'run':42B,93C 'self':39B 'self-host':38B 'server':48B,85B,97C,188C,235C 'set':216C,228C 'silent':224C 'sourc':199C 'ssrf':203C 'startup':121C,219C,294C 'stdio':253C,334C 'sylphx/pdf-reader-mcp':1A,24A,91C,260C 'time':275C 'tool':27B,79B,179C 'transport':3A,99C,250C,254C,335C 'unaffect':256C 'unauthent':5A,156C 'unless':210C 'upgrad':312C 'url':197C 'url-bas':196C 'use':331C 'valid':125C 'variabl':108C,141C 'via':355C 'warn':295C 'without':303C 'workaround':307C 'x':61B,116C,128C,267C 'x-api-key':60B,115C,127C,266C","nicknames":[],"mitigations":[],"who_affected":"Only deployments running the HTTP transport (MCP_TRANSPORT=http) are exposed; the default stdio transport is not affected. Servers bound to all interfaces, which is the default bind, are reachable by any client that can reach the port, so they are the priority to look at. Teams that run it over stdio on a developer machine can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T16:34:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-q344-5v34-gm84","url":"https://github.com/advisories/GHSA-q344-5v34-gm84","severity":"high","published_at":"2026-10-29T16:34:35+00:00","modified_at":"2026-10-29T16:34:38+00:00","first_seen_at":"2026-10-29T16:39:03+00:00","fetched_at":"2026-10-29T16:39:03+00:00","note":null}],"documents":[{"id":17832,"url":"https://api.github.com/repos/SylphxAI/anymd/security-advisories/GHSA-q344-5v34-gm84","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":17833,"url":"https://github.com/SylphxAI/pdf-reader-mcp/security/advisories/GHSA-q344-5v34-gm84","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}