sylphx pdf-reader-mcp: HTTP transport authentication bypass (CVE-2026-62264)

The @sylphx/pdf-reader-mcp package (v2.2.0 through 3.0.0) fails to enforce the X-API-Key header when the HTTP transport is enabled. Despite configuring an MCP_API_KEY, the application fails to validate the key, resulting in the /mcp endpoint accepting unauthenticated requests. Because the default bind address is 0.0.0.0, any actor with network access to the server can execute PDF parsing tools and access arbitrary files accessible to the application process.

Impact

Successful exploitation allows unauthorized actors to read any PDF file accessible to the server process and leverage PDF parsing tools. The vulnerability also supports limited Server-Side Request Forgery (SSRF) capabilities. The issue is exacerbated by misleading startup logs that incorrectly confirm authentication as enabled.

Recommendation

• Upgrade to @sylphx/pdf-reader-mcp@3.0.1 or later, which enforces API key validation and defaults to loopback-only binding.
• If immediate patching is not possible, restrict network exposure by setting MCP_HTTP_HOST to 127.0.0.1.
• Implement a reverse proxy with authentication enforcement in front of any instances exposed to non-local networks.
• Restrict filesystem access by explicitly defining MCP_PDF_ALLOWED_DIRS for the server process.