CVE-2026-62264
Received Received - Intake

Authentication Bypass in PDF Reader MCP via Missing API Key Validation

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: GitHub, Inc.

Description
PDF Reader MCP is a Model Context Protocol server for reading PDF documents. In versions 2.2.0 and later prior to 3.0.1, when `MCP_TRANSPORT=http` enables the opt-in HTTP server, `@sylphx/pdf-reader-mcp` reads `MCP_API_KEY` and logs that `X-API-Key` authentication is enabled but never validates the `X-API-Key` header on incoming requests. The `/mcp` endpoint consequently accepts unauthenticated clients. With the default bind address of `0.0.0.0`, any client able to reach the port can invoke every PDF tool and read any PDF the server process can open on the host, despite the misleading authentication-enabled startup log. URL-based sources additionally permit limited server-side request forgery; private and loopback destinations are blocked by default unless `--allow-private-ips` is set. The default `stdio` transport is unaffected. This issue is fixed in version 3.0.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-62264

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
SylphxAI pdf-reader-mcp >= 2.2.0, < 3.0.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

PDF Reader MCP versions 2.2.0 to 3.0.0 have an authentication bypass issue when the HTTP server is enabled via MCP_TRANSPORT=http. The application logs that API key authentication is enabled but fails to validate the X-API-Key header. This allows unauthenticated access to the /mcp endpoint, letting any client invoke PDF tools and read any accessible PDF files on the host system.

Detection Guidance

Check if the PDF Reader MCP server is running with HTTP transport enabled by inspecting process logs for 'MCP_TRANSPORT=http' and 'X-API-Key authentication is enabled' messages. Verify if the server is bound to 0.0.0.0 using netstat or ss commands like 'netstat -tulnp | grep 0.0.0.0' or 'ss -tulnp | grep 0.0.0.0'.

Impact Analysis

If you run a vulnerable version with HTTP transport enabled, attackers on the network can access your PDF tools and read any PDF files the server process can open. This includes sensitive documents if the server has permissions to read them. The default bind address 0.0.0.0 exposes this risk to any network-reachable client.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection such as GDPR and HIPAA due to unauthorized access to sensitive PDF documents. It enables data breaches by allowing unauthenticated parties to read files the server can access, potentially exposing personal or protected health information.

Mitigation Strategies

Upgrade to version 3.0.1 or later immediately. If upgrading is not possible, disable the HTTP transport by removing 'MCP_TRANSPORT=http' from environment variables or configuration. Ensure the server is bound to 127.0.0.1 instead of 0.0.0.0 to restrict access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62264. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart