Executive brief
camofox-mcp is an MCP server that exposes browser-control tools for automation tasks. The HTTP endpoint lacks authentication, allowing any network client that can reach it to invoke browser-control operations (tab creation, navigation, screenshot capture) using the server's configured credentials, even without knowing the backend API key.
Technical details
The vulnerability is a missing authentication check (CWE-306) on the HTTP MCP endpoint at /mcp in camofox-mcp versions before 1.13.2. The Express POST handler applies only rate limiting and does not validate inbound Authorization headers or API keys before passing requests to the MCP transport. Although the server forwards CAMOFOX_API_KEY to the backend browser service, that key only protects outbound requests and provides no authentication for inbound HTTP MCP clients. An unauthenticated attacker on the network can reach the endpoint and invoke all exposed MCP tools (46 in the PoC). The attack requires network reachability to the /mcp endpoint; default deployments bind to 127.0.0.1, reducing exposure, but HTTP/remote-client, Docker, or reverse-proxy deployments are at higher risk. The fix (v1.13.2) adds inbound CAMOFOX_HTTP_API_KEY Bearer authentication, public-bind validation, and host-header protection.
Affected products
- redf0x1 camofox-mcp < 1.13.2
Timeline
- 2026-05-19: disclosed
- 2026-05-19: patched: Fixed in v1.13.2