CVE-2026-62264

Name of the Vulnerable Software and Affected Versions PDF Reader MCP versions 2.2.0 through 3.0.0

Description When the opt-in HTTP server is enabled via MCP TRANSPORT=http, the server logs that X-API-Key authentication is active after reading the MCP API KEY variable, but it fails to validate the X-API-Key header on incoming requests. This allows unauthenticated clients to access the /mcp endpoint. Because the default bind address is 0.0.0.0, any client reaching the port can invoke all PDF tools and read any PDF file accessible to the server process on the host. Additionally, URL-based sources allow limited server-side request forgery (SSRF), a vulnerability where an attacker induces the server to make requests to an unintended location, although private and loopback destinations are blocked unless --allow-private-ips is enabled. The default stdio transport is not affected.

Recommendations Update PDF Reader MCP to version 3.0.1. As a temporary workaround, bind the server to the loopback address by setting MCP HTTP HOST=127.0.0.1. As a temporary workaround, place a reverse proxy in front of the server to enforce authentication. As a temporary workaround, use the default stdio transport instead of HTTP. As a temporary workaround, restrict filesystem access using --allow-dir or MCP PDF ALLOWED DIRS.