CVE-2026-62264: @sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY
When @sylphx/pdf-reader-mcp is run as an HTTP server (MCP_TRANSPORT=http), it reads the MCP_API_KEY environment variable and logs API key authentication enabled (X-API-Key header) at startup, but it never validated the X-API-Key header on incoming requests. The key was read into a variable and never enforced on the request path.
As a result, the /mcp endpoint accepted unauthenticated requests. Combined with the default bind address of 0.0.0.0 (all interfaces), any client able to reach the port could invoke every PDF tool and read the contents of any PDF the server process could open anywhere on the host. URL-based sources also enable limited SSRF (private/loopback addresses are blocked by default unless --allow-private-ips is set).
The misleading startup log made the exposure silent: an operator who set MCP_API_KEY reasonably believed the server was protected when it was not.
This affects only the opt-in HTTP transport; the default stdio transport is unaffected.
References
- github.com/SylphxAI/anymd/commit/4c35f72862d729301e3912ab8c8317d2828cf4c2
- github.com/SylphxAI/anymd/pull/332
- github.com/SylphxAI/anymd/releases/tag/v3.0.1
- github.com/SylphxAI/pdf-reader-mcp/security/advisories/GHSA-q344-5v34-gm84
- github.com/advisories/GHSA-q344-5v34-gm84
- nvd.nist.gov/vuln/detail/CVE-2026-62264
Code Behaviors & Features
Detect and mitigate CVE-2026-62264 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →