Executive brief
The mcp-router CLI tool, used to aggregate and manage MCP (Model Context Protocol) servers, served on all network interfaces by default without requiring authentication. An attacker on the same network could access the exposed aggregator and any servers it manages without credentials, potentially gaining unauthorized control over the system and the data/services it provides. The vulnerability was fixed in version 0.6.3 to bind to localhost by default and mandate authentication on non-loopback addresses.
Technical details
The vulnerability exists in the serve command (apps/cli/src/commands/serve.ts) where the default host binding was set to 0.0.0.0 (all interfaces) on a fixed port, and authentication via token was optional and only enforced when the operator explicitly supplied the corresponding flag. This meant a default invocation exposed the MCP aggregator and all fronted MCP servers to any network-adjacent attacker. The attack requires only network reachability to the port and no authentication. Version 0.6.3 remedies this by defaulting the host to the loopback address (127.0.0.1) and refusing to start without a token when a non-loopback host is specified; no earlier version contains these checks.
Affected products
- mcp-router mcp-router <0.6.3
Timeline
- 2026-08-27: disclosed
- 2026-08-27: patched: Fixed in version 0.6.3