id: CVE-2026-81094

info:
  name: "mcp-router CLI - Unauthenticated MCP Aggregator Exposure"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    The mcp-router CLI served its MCP aggregator on every interface and required a token only
    when the operator passed the corresponding flag. The serve command in
    apps/cli/src/commands/serve.ts defaulted its host to the all-interfaces address on a fixed
    port, so a default invocation exposed the aggregator, and every MCP server it fronts, to
    anyone able to reach the port. An unauthenticated attacker can complete the MCP initialize
    handshake and reach the fronted tools. Fixed in release 0.6.3.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-81094&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=mcp-router&match=exact
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
    cvss-score: 9.3
    cve-id: CVE-2026-81094
    cwe-id: CWE-306
  metadata:
    verified: false
  tags: cve,cve2026,mcp-router,mcp,auth-bypass
http:
  - raw:
      - |
        POST /mcp HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        Accept: application/json, text/event-stream

        {"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"mcp","version":"1.0"}}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "protocolVersion")'
          - 'contains(body, "jsonrpc")'
          - 'status_code == 200'
        condition: and