Executive brief
The @cardano402/mcp-server package, which connects AI models to Cardano blockchain wallets, contains multiple security flaws that could lead to the theft of digital assets. An attacker on the same local network could trigger unauthorized payments, or a malicious AI prompt could drain a user's wallet because the software lacks spending limits and transaction confirmations. Additionally, the software can be tricked into making unauthorized requests to internal company systems.
Technical details
The @cardano402/mcp-server (versions <= 0.1.1) suffers from three primary security issues. First, it lacks spending limits or confirmation hooks (CWE-770), allowing an LLM to repeatedly sign transactions and drain wallets. Second, when using HTTP transport, the server binds to 0.0.0.0 without authentication or CORS protection (CWE-862), allowing any user on the local network to trigger wallet actions. Third, it is vulnerable to SSRF (CWE-918) and path traversal (CWE-22) via the 'catalog.server.url' and 'endpoint.path' parameters, as it fails to validate internal IP ranges or normalize paths. These issues are addressed in version 0.1.2 by implementing spending caps, requiring bearer tokens for non-loopback HTTP traffic, and adding CIDR-based URL validation.
Affected products
- MorganOnCode @cardano402/mcp-server <= 0.1.1
Timeline
- 2026-05-25: disclosed
- 2026-06-26: advisory: Published to GitHub Advisory Database