Executive brief
MCP Connect is a Node.js server that bridges HTTP requests to MCP (Model Context Protocol) services. In its default configuration, the /bridge endpoint is completely unauthenticated and allows attackers to execute arbitrary operating system commands with the privileges of the user running the server. This permits full host compromise including credential theft, backdoor installation, and data destruction.
Technical details
The vulnerability stems from two design flaws: (1) authentication enforcement is wrapped in a conditional that treats empty strings as falsy, so when no AUTH_TOKEN or ACCESS_TOKEN environment variable is set, the entire auth block is skipped and requests are accepted unconditionally; and (2) the /bridge endpoint accepts serverPath and args from untrusted JSON request bodies and passes them directly to a process spawner without validation, allowlisting, or sanitization. An unauthenticated attacker with network access can POST a crafted JSON payload to trigger arbitrary command execution. The service binds to all interfaces (0.0.0.0) by default and can be further exposed via the start:tunnel npm script, maximizing attack surface. No patch is currently available.
Affected products
- EvalsOne mcp-bridge <= 2.0.0
Timeline
- 2026-03-19: disclosed: Published as GHSA-wvr4-3wq4-gpc5