Description

The mcp-router CLI served its MCP aggregator on every interface and enforced authentication only when the operator asked for it. The serve command in apps/cli/src/commands/serve.ts defaulted its host to the all-interfaces address on a fixed port, and required a token only when the corresponding flag was supplied, so a default invocation exposed the aggregator, and every MCP server it fronted, to anyone able to reach the port. Release 0.6.3 defaults the host to the loopback address and refuses to start without a token whenever the host it is given is not a loopback address; no earlier release carries either check.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-27T17:20:51.650Z",
  "pubdate": "2026-08-27T17:20:51.650Z",
  "executiveSummary": "The mcp-router CLI is vulnerable to unauthorized access due to insecure default network binding and optional authentication enforcement. In versions prior to 0.6.3, the 'serve' command automatically exposes the MCP aggregator and all associated MCP servers on all network interfaces by default. Furthermore, authentication via token is not enforced by default, allowing any remote actor with network connectivity to the service port to interact with the aggregator without credentials. This misconfiguration leads to significant security implications, including unauthorized command execution, information disclosure, and potential compromise of the backend MCP infrastructure. The lack of mandatory access controls effectively transforms a private developer tool into a public-facing service, granting an attacker full control over the exposed MCP operations. Exploitation does not require specialized skills or pre-existing privileges, as the exposure occurs immediately upon invocation of the default serve command. Organizations relying on mcp-router are at risk of lateral movement and service exploitation unless they have explicitly configured restricted access or upgraded to a secure release.",
  "technicalDetails": "The vulnerability resides in the implementation of the serve command within apps/cli/src/commands/serve.ts. Prior to version 0.6.3, the application logic defaulted the binding host to the wildcard address (0.0.0.0 or equivalent), which instructs the operating system to listen on all available network interfaces, including public-facing ones. This design choice inherently exposes the service to external network segments beyond the local machine.\nConcurrently, the authentication mechanism for the MCP aggregator was designed as an optional feature rather than a security baseline. The command-line interface logic only enforced the requirement of an authentication token if the operator explicitly provided the corresponding flag during invocation. Consequently, the default execution path—invoked without specific hardening flags—leaves the service in an unauthenticated state.\nThe attack flow proceeds as follows: 1) An operator executes the mcp-router CLI in its default configuration; 2) The service binds to all network interfaces on a fixed port; 3) The service initializes without requiring an authentication token, as the default state treats security as an optional configuration rather than an enforced requirement; 4) A remote attacker identifies the open port on the host via network scanning; 5) The attacker initiates an MCP protocol handshake with the aggregator. Because the service lacks authentication and is exposed to the network, the attacker gains the ability to issue commands, interact with fronted MCP servers, and potentially manipulate data or proxy requests through the aggregator.\nThe root cause is a failure to apply the principle of secure-by-default design. By defaulting to a non-local interface and omitting mandatory authentication, the application introduces a large attack surface. The impact is a critical authorization bypass, allowing unauthenticated remote entities to perform operations that the service was intended to restrict. In versions 0.6.3 and later, the developers mitigated this by hardcoding the default host to the loopback address (127.0.0.1) and introducing an explicit check that prevents the service from starting unless a valid token is provided whenever a non-loopback host is specified. This forces the operator to acknowledge the security requirements when exposing the service externally."
}