CVE-2026-100868 in Penpot
Summary
by MITRE • 09/27/2026
Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return forged results to the MCP client.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/27/2026
The vulnerability identified in versions of Penpot prior to 2.18.0 represents a critical misconfiguration within its single-user deployment mode that exposes internal communication channels to unauthorized network access. Specifically, the Model Context Protocol server plugin WebSocket bridge is bound to all available network interfaces rather than being restricted to localhost or authenticated endpoints. This architectural oversight effectively transforms an internal service intended for local browser-plugin interaction into a publicly accessible resource on adjacent networks. The absence of any authentication mechanism means that any entity capable of reaching the host over the network can initiate connections to this WebSocket port without providing credentials, bypassing fundamental security controls designed to isolate sensitive operational components from external actors.
From a technical perspective, the flaw lies in the binding configuration of the WebSocket server component associated with the MCP plugin. By listening on zero-zero-zero-zero or all interfaces instead of 127.0.0.1, the service becomes reachable by any client within the same broadcast domain or network segment. An attacker positioned on an adjacent network can exploit this exposure to establish a direct connection to the WebSocket endpoint. Once connected, the attacker is able to impersonate the legitimate Penpot browser plugin due to the lack of mutual authentication or certificate validation requirements in the protocol handshake and subsequent message exchange. This allows the adversary to inject malicious payloads into the task stream intended for the MCP client and return forged results that appear authentic to the receiving system.
The operational impact of this vulnerability is severe, as it enables a man-in-the-middle style attack where the attacker can intercept, modify, or fabricate data exchanged between the Penpot application components. By returning forged results, an adversary could manipulate design outputs, inject malicious code into generated assets, or disrupt service availability through resource exhaustion attacks facilitated by the open channel. This compromises the integrity of the design platform and potentially exposes sensitive project data if such information is transmitted over this unauthenticated bridge. The ability to impersonate a trusted component undermines the trust model of the application, allowing for potential privilege escalation within the context of the Penpot service or further lateral movement if other services are linked through shared credentials or session tokens exposed via these forged interactions.
This vulnerability aligns with CWE-284 Improper Access Control and CWE-798 Use of Hard-coded Credentials in terms of its failure to enforce authentication, as well as CWE-319 Cleartext Transmission of Sensitive Information if the intercepted payloads contain confidential data. In the context of the MITRE ATT&CK framework, this scenario maps to T1046 Network Service Discovery for identifying the open port and T1557 Adversary-in-the-Middle for intercepting and modifying communications between two compromised or trusted components. The exploitation vector is classified as adjacent network access, which lowers the barrier to entry significantly compared to remote internet-facing exploits but remains highly dangerous in shared hosting environments or corporate networks where lateral movement is feasible.
Mitigation strategies must prioritize immediate isolation of the affected service until an upgrade can be performed. Administrators should restrict the WebSocket bridge binding address to localhost only, ensuring that it is not accessible from any external network interface. If local access is required for development purposes, firewall rules should be implemented to permit connections exclusively from trusted loopback addresses or specific authorized IP ranges. Upgrading Penpot to version 2.18.0 or later resolves this issue by correcting the binding configuration and implementing proper authentication checks for the MCP server plugin WebSocket bridge. Additionally, network segmentation policies should be reviewed to ensure that critical application components are not exposed on shared subnets where untrusted hosts can reside, thereby reducing the attack surface available to adjacent attackers seeking to exploit similar misconfigurations in other services.