Product
The mcp-router CLI versions prior to 0.6.3 default to binding the MCP aggregator service to all network interfaces without mandatory authentication, exposing fronted MCP servers to unauthorized remote access.