CVE-2026-62264

PDF Reader MCP HTTP mode does not enforce its configured API key

SylphxAI · @sylphx/pdf-reader-mcp HTTP transport

First documented disclosure · Review checkpoint

Summary

An exposed HTTP server can allow unauthenticated access despite logging that API-key authentication is enabled.

Severity and exploitation evidence

High · 7.5/10 · CVSS 3.1. Severity source.

Exploitation not established: The maintainer documents the flaw and authentication regression checks. No reviewed source establishes malicious exploitation or confirmed victims.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The server reads MCP_API_KEY but never checks incoming X-API-Key headers; the old bind default exposes all interfaces.

Conditions required

Opt-in HTTP transport and network access to its listener. The default stdio transport is unaffected.

Potential impact

Read PDFs accessible to the server process and limited URL-based SSRF. Private and loopback destinations are blocked by default unless explicitly enabled.

Affected versions and configurations

>=2.2.0 and <3.0.1.

Fix and mitigation status

3.0.1 enforces configured API keys, defaults to loopback and warns about non-loopback exposure without a key.

Practical next steps

Upgrade, configure an API key or authenticated proxy, keep the listener private and restrict filesystem directories. Stdio avoids the affected HTTP path.

Operating lesson

A configured secret is not an access control until every protected request verifies it.

Evidence and limits

The maintainer advisory, public fix and release date to June 25; October 29 is later GitHub advisory-database ingestion. The CVE Program published the exact CNA record on October 30. The November 1 recheck confirms the same affected range, issue-specific fix and CVSS 3.1 score; registry publication does not replace the earlier disclosure date. The repository now redirects from pdf-reader-mcp to anymd.

Sources