CVE-2026-48989

Name of the Vulnerable Software and Affected Versions Windows-MCP versions prior to 0.7.5

Description In SSE and Streamable HTTP transport modes, the MCP control plane is exposed without authentication and utilizes wildcard CORS (Cross-Origin Resource Sharing), which allows any origin, method, or header. This configuration permits arbitrary origins or non-browser clients to access the control plane. Because the server also exposes a PowerShell tool that executes caller-controlled commands via the command variable as the Windows user running the application, an attacker can achieve arbitrary PowerShell execution. The issue stems from the http middleware() function installing CORSMiddleware with wildcard policies and the build mcp() function constructing the instance without an authentication provider. The vulnerability is specifically triggered when using the '/mcp' endpoint to initialize a session and invoke the tools/call function for the PowerShell tool.

Recommendations Update to version 0.7.5. As a temporary workaround, avoid using SSE and Streamable HTTP transport modes and use the default stdio mode instead.