CVE-2026-81098

Name of the Vulnerable Software and Affected Versions Telnyx MCP server (affected versions not specified)

Description The HTTP transport was exposed on all network interfaces and did not require caller credentials. In the file packages/mcp-server/src/http.ts, the server served the Model Context Protocol (MCP) on the root path with a listener bound to all interfaces. The authentication header parsing logic did not fail when credentials were absent, allowing unauthenticated requests to complete initialization and dispatch tools. Consequently, the server forwarded its own stored credentials, including the Telnyx API key, client secret, and code-execution key, to the upstream endpoint, allowing any caller with network access to the port to act with these privileges.

Recommendations Update the server to a version where the host defaults to loopback, a server API key is required, and enforcement is handled via middleware.