CVE-2026-54504 in MCP Documentation Server
Summary
by MITRE • 09/17/2026
MCP Documentation Server is a local-first document management and semantic search server for AI coding agents. From 1.13.0 until 1.13.1, the automatically started Web UI in src/server.ts calls startWebServer in src/web-server.ts with START_WEB_UI enabled by default and WEB_PORT set to 3080. startWebServer uses app.listen(PORT) without a host, which binds the unauthenticated document-management API to all interfaces rather than localhost. A network-reachable client can invoke GET /api/documents, GET /api/documents/:id, POST /api/documents, POST /api/search-all, DELETE /api/documents/:id, and GET /api/config without credentials to enumerate and read documents, search the corpus, insert or delete documents, and tamper with the MCP assistant's knowledge base. The service must be reachable from the attacker's LAN, VM network, container bridge, VPN, or another routed network, and the issue does not provide remote code execution. This issue is fixed in 1.13.1.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in MCP Documentation Server versions prior to 1.13.1 constitutes a critical misconfiguration of service binding that results in unauthorized exposure of sensitive data and administrative functions over the network. The core technical flaw lies within the server initialization logic, specifically in how the web interface is launched when the START_WEB_UI environment variable or configuration flag is enabled by default. During this process, the application invokes startWebServer with a port assignment but fails to specify a host parameter for the listening socket. In standard Node.js HTTP and HTTPS server implementations, omitting the host argument causes the service to bind to 0.0.0.0, which instructs the operating system to accept incoming connections on all available network interfaces rather than restricting access exclusively to localhost or 127.0.0.1. This architectural oversight effectively bypasses local-only security boundaries that are typically expected for development tools and internal management utilities, transforming a locally intended service into one that is globally reachable within the scope of any connected network segment.
The operational impact of this binding misconfiguration allows unauthenticated actors to interact directly with the document-management API endpoints without providing valid credentials or authentication tokens. An attacker who has network reachability to the affected host can exploit several exposed routes, including GET requests for enumerating documents and retrieving specific content by identifier, POST requests for inserting new documents into the knowledge base, DELETE requests for removing existing records, and access to configuration settings via GET /api/config. Furthermore, the availability of a search-all endpoint permits full-text searching across the entire document corpus stored within the system. This exposure enables adversaries to perform comprehensive reconnaissance, extract proprietary or sensitive information contained in managed documents, manipulate the integrity of the knowledge base by adding false data or deleting critical records, and potentially influence downstream AI coding agents that rely on this MCP server for context retrieval. The ability to tamper with the assistant's knowledge base is particularly severe as it can lead to indirect code injection vulnerabilities if malicious content is later retrieved and executed in a development environment.
From a classification perspective, this vulnerability aligns closely with CWE-284 Improper Access Control, specifically regarding the failure to restrict access to resources based on network location or interface binding. It also reflects aspects of CWE-798 Use of Hard-coded Credentials if one considers the implicit lack of authentication as a form of default insecure configuration, though it is more accurately described as an exposure of sensitive information due to improper service binding (CWE-200). In terms of adversary tactics, this scenario maps directly to ATT&CK technique T1539 Steal Web Session Cookie if session tokens were exposed via the config endpoint, but primarily falls under T1078 Valid Accounts when considering that no accounts are required due to the lack of authentication checks. The attack vector is classified as Network (ATT&CK T1046) because it requires network reachability from a LAN, VM network, container bridge, or VPN, rather than direct physical access or local privilege escalation on the host itself. It is important to note that while this vulnerability allows for significant data manipulation and exfiltration, it does not provide remote code execution capabilities directly against the server operating system or runtime environment.
Mitigation strategies focus primarily on correcting the network binding configuration and enforcing strict authentication policies. The immediate remediation involves upgrading to version 1.13.1 where the default behavior has been corrected to bind only to localhost unless explicitly overridden by secure configurations. For environments that cannot immediately upgrade, administrators should configure the application to start with a specific host parameter set to 127.0.0.1 or ::1 in the server initialization code or via environment variables if supported. Additionally, implementing network-level controls such as firewall rules to block external access to port 3080 is essential for defense-in-depth. Security teams should also audit all development and internal tools that expose APIs over HTTP without authentication, ensuring that default configurations prioritize security by restricting access to loopback interfaces only. Regular vulnerability scanning of internal networks can help detect services bound to 0.0.0.0 that were not intended to be publicly accessible within the organizational perimeter.