Sylphx - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/sylphx/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 18:38:00 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgsylphx pdf-reader-mcp: HTTP transport authentication bypass (CVE-2026-62264)https://feed.craftedsignal.io/briefs/2026-10-sylphx-pdf-reader-mcp-auth-bypass/Thu, 29 Oct 2026 18:38:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-sylphx-pdf-reader-mcp-auth-bypass/The @sylphx/pdf-reader-mcp package contains an authentication bypass vulnerability in its HTTP transport implementation that exposes local files and PDF tools to unauthorized network requests.The @sylphx/pdf-reader-mcp package (v2.2.0 through 3.0.0) fails to enforce the X-API-Key header when the HTTP transport is enabled. Despite configuring an MCP_API_KEY, the application fails to validate the key, resulting in the /mcp endpoint accepting unauthenticated requests. Because the default bind address is 0.0.0.0, any actor with network access to the server can execute PDF parsing tools and access arbitrary files accessible to the application process.

Impact

Successful exploitation allows unauthorized actors to read any PDF file accessible to the server process and leverage PDF parsing tools. The vulnerability also supports limited Server-Side Request Forgery (SSRF) capabilities. The issue is exacerbated by misleading startup logs that incorrectly confirm authentication as enabled.

Recommendation

  • Upgrade to @sylphx/pdf-reader-mcp@3.0.1 or later, which enforces API key validation and defaults to loopback-only binding.
  • If immediate patching is not possible, restrict network exposure by setting MCP_HTTP_HOST to 127.0.0.1.
  • Implement a reverse proxy with authentication enforcement in front of any instances exposed to non-local networks.
  • Restrict filesystem access by explicitly defining MCP_PDF_ALLOWED_DIRS for the server process.
]]>highadvisoryauthentication-bypasscve-2026-62264mcpnodejs