CVE-2026-54504: @andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without authentication by default
(updated )
@andrea9293/mcp-documentation-server v1.13.0 documents that a Web UI starts automatically on port 3080. However, the Web UI/API appears to bind to all network interfaces by default (*:3080 / 0.0.0.0:3080) instead of localhost-only, and its document-management API endpoints do not require authentication.
As a result, any network-reachable client on the same LAN, VM network, or container bridge can access the document-admin API without credentials. In my reproduction, I was able to enumerate documents, add a document, read its full content, search across the corpus, and delete the document through the host’s LAN IP.
The issue is not that a Web UI exists. The issue is that a local document-management Web UI/API is exposed on all interfaces by default without authentication.
References
- github.com/advisories/GHSA-6f5r-5672-72j7
- github.com/andrea9293/mcp-documentation-server/commit/37159d4e06b8ee50c3645b2496e3d3f6d32c47f9
- github.com/andrea9293/mcp-documentation-server/releases/tag/v1.13.1
- github.com/andrea9293/mcp-documentation-server/security/advisories/GHSA-6f5r-5672-72j7
- nvd.nist.gov/vuln/detail/CVE-2026-54504
Code Behaviors & Features
Detect and mitigate CVE-2026-54504 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →