PDF Reader MCP: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY
Affects @sylphx/pdf-reader-mcp and pdf-reader-mcp from 2.2.0 up to but not including 3.0.1 when the HTTP transport is enabled. CVSS scores it 7.5 (high), and no vendor rating is given. Fixed in 3.0.1.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 3.0.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
PDF Reader MCP is a Model Context Protocol server for reading PDF documents. In versions 2.2.0 and later prior to 3.0.1, when `MCP_TRANSPORT=http` enables the opt-in HTTP server, `@sylphx/pdf-reader-mcp` reads `MCP_API_KEY` and logs that `X-API-Key` authentication is enabled but never validates the `X-API-Key` header on incoming requests. The `/mcp` endpoint consequently accepts unauthenticated clients. With the default bind address of `0.0.0.0`, any client able to reach the port can invoke every PDF tool and read any PDF the server process can open on the host, despite the misleading authentication-enabled startup log. URL-based sources additionally permit limited server-side request forgery; private and loopback destinations are blocked by default unless `--allow-private-ips` is set. The default `stdio` transport is unaffected. This issue is fixed in version 3.0.1.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- SylphxAI pdf-reader-mcp
From 2.2.0 · fixed in 3.0.1
- @sylphx/pdf-reader-mcpnpm
From 2.2.0 · fixed in 3.0.1
References 4
GitHub · SylphxAI/anymd
Questions about CVE-2026-62264
What does this mean?
The HTTP transport does not enforce the MCP_API_KEY it reads, so a remote client without a key can call every PDF tool and read any PDF the server process can open on the host. URL-based sources also allow limited server-side request forgery.Source: github.com
Am I affected, and how do I check?
Versions 2.2.0 up to but not including 3.0.1 are affected, and only when the HTTP transport is enabled with MCP_TRANSPORT=http. The default stdio transport is not affected. The default bind address is 0.0.0.0 (all interfaces), so check the installed version and whether MCP_TRANSPORT is set to http.Source: github.com
What should I do about it?
Upgrade to @sylphx/pdf-reader-mcp 3.0.1, which fixes the issue. Until then, set MCP_HTTP_HOST=127.0.0.1 to bind the server to loopback only.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data