Executive brief
@cardano402/mcp-server is an npm package that exposes Cardano blockchain payment tools through an MCP (Model Context Protocol) interface, allowing Large Language Models to initiate cryptocurrency transactions. The package in versions 0.1.1 and earlier lacks spending limits on signed transactions, exposes an unauthenticated HTTP endpoint accessible across a LAN, and accepts malicious catalog URLs that can trigger Server-Side Request Forgery attacks against internal infrastructure. An attacker could drain a user's cryptocurrency wallet, intercept LAN-based payment requests, or access sensitive internal systems.
Technical details
The package contains three distinct vulnerabilities: (1) Missing spending controls—LLMs can repeatedly invoke payment tools without per-call caps, daily limits, recipient allowlists, or confirmation steps, allowing wallet drain via prompt injection; (2) Unauthenticated LAN exposure—the HTTP transport binds to 0.0.0.0 without authentication, Origin validation, or bearer-token checks, enabling any LAN peer to invoke MCP tools; (3) Server-Side Request Forgery via catalog.server.url—the allowInsecure validation only checks the catalog URL itself, not the server.url returned by a malicious catalog, and endpoint.path traversal is not normalized, permitting attacks on RFC1918 private networks (e.g., AWS metadata). Attack vectors are network-reachable (LAN or Internet via catalog compromise) and require no authentication for LAN-bound HTTP mode. Fix available in version 0.1.2 adds per-call/daily spending limits, loopback-default HTTP binding, bearer-token enforcement, CIDR-based server.url validation, and path traversal protection.
Affected products
- MorganOnCode mcp-server <= 0.1.1
Timeline
- 2026-06-26: disclosed
- 2026-06-26: patched: Fixed in @cardano402/mcp-server@0.1.2