Description

The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller credential. packages/mcp-server/src/http.ts served MCP on the root path with a listener bound to all interfaces and parsed the caller's authentication headers in a mode that did not fail when they were absent, so a request without any credential completed initialisation and dispatched tools. Dispatch forwarded the server's own stored credentials, the Telnyx API key and client secret together with the code-execution key, to the upstream endpoint, so an unauthenticated caller able to reach the port acted with them. The current code defaults the host to loopback, requires a server API key, and enforces it in middleware.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-27T17:20:52.297Z",
  "pubdate": "2026-08-27T17:20:52.297Z",
  "executiveSummary": "The Telnyx MCP server contains a critical authentication bypass vulnerability originating from insecure transport configuration and improper credential validation in the HTTP layer.\nThe vulnerability allows unauthenticated remote attackers to interact with the MCP server, dispatch tools, and perform unauthorized actions using the server's own elevated credentials.\nAffected systems include the Telnyx MCP server implementation, specifically within the http.ts module, where the service was bound to all network interfaces without enforcing caller authentication.\nThe risk is severe, as the server incorrectly permits requests lacking authentication headers, thereby treating unauthenticated traffic as legitimate. By exploiting this, an attacker can hijack the server's identity, gaining unauthorized access to the Telnyx API and code-execution environment using the server's internally stored API keys and secrets.\nExploitation requires only network reachability to the server port, as no pre-existing authentication is required to bypass the server's security controls and dispatch tool requests.",
  "technicalDetails": "The root cause of this vulnerability is a combination of insecure network binding and permissive authentication middleware logic within the Telnyx MCP server's HTTP transport implementation.\nSpecifically, the file packages/mcp-server/src/http.ts configured the MCP service to listen on all network interfaces (0.0.0.0) rather than restricting binding to the local loopback interface. This exposes the MCP endpoint to external network traffic beyond the local host environment.\nThe authentication logic within the HTTP stack failed to properly enforce the presence of security credentials. While the system was designed to parse authentication headers, it did not explicitly fail when these headers were absent. Consequently, the application treated requests received without credentials as valid, proceeding to initialize sessions and dispatch requested tools.\nThe attack flow proceeds as follows: 1. An attacker identifies the exposed MCP port on a reachable network interface. 2. The attacker sends a crafted HTTP request to the root path of the MCP server, intentionally omitting the required authentication headers. 3. The server's http.ts implementation fails to drop the request, instead allowing the request to proceed to the tool dispatching logic. 4. Upon tool execution, the MCP server automatically forwards its own stored credentials—including the Telnyx API key, client secret, and code-execution key—to the upstream provider.\nBecause the server includes these sensitive credentials in the outgoing requests, an unauthenticated attacker effectively gains the ability to impersonate the Telnyx MCP server. This allows the attacker to execute arbitrary tools and interact with external services using the elevated privileges associated with the server’s stored secrets.\nThe post-exploitation impact includes unauthorized data access, potential code execution in the environment where the MCP server is authorized to run, and the compromise of API keys and client secrets. The vulnerability transitions from a simple authentication bypass to a full compromise of the server’s identity and configured integrations."
}