CVE-2026-81094
Received Received - Intake

MCP Router CLI Unauthorized Access Vulnerability

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VulnCheck

Description
The mcp-router CLI served its MCP aggregator on every interface and enforced authentication only when the operator asked for it. The serve command in apps/cli/src/commands/serve.ts defaulted its host to the all-interfaces address on a fixed port, and required a token only when the corresponding flag was supplied, so a default invocation exposed the aggregator, and every MCP server it fronted, to anyone able to reach the port. Release 0.6.3 defaults the host to the loopback address and refuses to start without a token whenever the host it is given is not a loopback address; no earlier release carries either check.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-09-17
AI Q&A
2026-08-27
EPSS Evaluated
2026-09-15
NVD
CVE-2026-81094
EUVD
EUVD-2026-67022

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
mcp-router mcp_router 0.6.3
mcp-router mcp_router 0.6.3.1
mcp-router mcp_router 0.2.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-81094 is a vulnerability in the mcp-router CLI where the MCP aggregator was exposed on all network interfaces by default without requiring authentication. Before version 0.6.3, the serve command bound to all interfaces and only enforced authentication if explicitly requested. This allowed unauthorized users to access the aggregator and connected MCP servers if they could reach the port.

Detection Guidance

Check if mcp-router is running on all interfaces without authentication. Use netstat or ss to see if the service is bound to 0.0.0.0. For example: netstat -tuln | grep 3000 or ss -tuln | grep 3000. If bound to all interfaces and no token is required, the system is vulnerable.

Impact Analysis

This vulnerability could allow attackers to remotely access and interact with your MCP servers without authentication. If the server is exposed to the internet or local network, unauthorized users might execute commands, exfiltrate data, or manipulate server functionality. The high CVSS score (9.3) reflects the significant risk of unauthorized access and potential data breaches.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other regulations by exposing sensitive data to unauthorized parties. GDPR requires protecting personal data, while HIPAA mandates safeguards for protected health information. Unauthorized access due to this flaw may result in data breaches, triggering regulatory penalties, fines, or legal consequences.

Mitigation Strategies

Upgrade to version 0.6.3 or later. Ensure the serve command defaults to localhost and requires a token when binding to non-loopback addresses. If using an older version, manually bind to 127.0.0.1 and enforce token authentication.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81094. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart