Executive brief
Windows-MCP is an open-source tool that allows AI agents to interact with the Windows operating system. In certain configurations, the tool's control interface was accessible over the network without any password or security checks, while also allowing any website to send commands to it. This allowed an attacker to remotely execute malicious PowerShell commands on the victim's computer, potentially leading to full system takeover or data theft.
Technical details
Windows-MCP versions prior to 0.7.5 contain a vulnerability in the SSE and Streamable HTTP transport modes. The application fails to implement an authentication provider for the MCP control plane and simultaneously enables wildcard Cross-Origin Resource Sharing (CORS) via OptionsMiddleware and CORSMiddleware (allow_origins=*). Because the service exposes a PowerShell tool that executes caller-provided commands using PowerShell -EncodedCommand, a remote attacker or a malicious website can bypass the Same-Origin Policy to invoke the 'tools/call' method. This results in arbitrary PowerShell execution with the privileges of the user running the Windows-MCP process. The fix in version 0.7.5 removes wildcard CORS by default, introduces a trusted origin allowlist, and implements DNS rebinding protection.
Affected products
- CursorTouch Windows-MCP < 0.7.5
Timeline
- 2026-05-14: disclosed: Vulnerability reported by security researcher
- 2026-05-14: patched: Version 0.7.5 released with security fixes
- 2026-06-17: advisory: CVE-2026-48989 published