CVE-2026-54504: @andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without authentication by default
(updated )
@andrea9293/mcp-documentation-server v1.13.0 documents that a Web UI starts automatically on port 3080. However, the Web UI/API appears to bind to all network interfaces by default (*:3080 / 0.0.0.0:3080) instead of localhost-only, and its document-management API endpoints do not require authentication.
As a result, any network-reachable client on the same LAN, VM network, or container bridge can access the document-admin API without credentials. In my reproduction, I was able to enumerate documents, add a document, read its full content, search across the corpus, and delete the document through the host’s LAN IP.
The issue is not that a Web UI exists. The issue is that a local document-management Web UI/API is exposed on all interfaces by default without authentication.
References
- github.com/advisories/GHSA-6f5r-5672-72j7
- github.com/andrea9293/mcp-documentation-server/commit/37159d4e06b8ee50c3645b2496e3d3f6d32c47f9
- github.com/andrea9293/mcp-documentation-server/releases/tag/v1.13.1
- github.com/andrea9293/mcp-documentation-server/security/advisories/GHSA-6f5r-5672-72j7
- nvd.nist.gov/vuln/detail/CVE-2026-54504
Code Behaviors & Features
Detect and mitigate CVE-2026-54504 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →