PDF Reader MCP: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY

published 2026-10-29 10 d ago modified 2026-11-06 2 d ago also GHSA-q344-5v34-gm84 , EUVD-2026-114317

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 39%
public exploits: 0; none known

PDF Reader MCP is a Model Context Protocol server for reading PDF documents. In versions 2.2.0 and later prior to 3.0.1, when `MCP_TRANSPORT=http` enables the opt-in HTTP server, `@sylphx/pdf-reader-mcp` reads `MCP_API_KEY` and logs that `X-API-Key` authentication is enabled but never validates the `X-API-Key` header on incoming requests. The `/mcp` endpoint consequently accepts unauthenticated clients. With the default bind address of `0.0.0.0`, any client able to reach the port can invoke every PDF tool and read any PDF the server process can open on the host, despite the misleading authentication-enabled startup log. URL-based sources additionally permit limited server-side request forgery; private and loopback destinations are blocked by default unless `--allow-private-ips` is set. The default `stdio` transport is unaffected. This issue is fixed in version 3.0.1.

Patch / fix

fixed in 1 links 3

npm @sylphx/pdf-reader-mcp 3.0.1

github.com/SylphxAI/anymd@4c35f72 commit
github.com/SylphxAI/anymd#332 pull request
github.com/SylphxAI/anymd/releases/tag/v3.0.1 release

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 2 d ago (2026-11-06)

Exploit prediction

0.45% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
GitHub	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
npm	@sylphx/pdf-reader-mcp	>=2.2.0, <3.0.1	3.0.1

Affected products

SylphxAI pdf-reader-mcp

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-287 Improper Authentication
CWE-306 Missing Authentication for Critical Functionality

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary