CVE-2026-48989 Details
Description
Windows-MCP is an open-source project that integrates AI agents with Windows. In versions prior to 0.7.5, certain HTTP modes exposed the MCP control plane without authentication while enabling wildcard CORS (allow_origins=*, allow_methods=*, allow_headers=*). Because the same server also exposed a PowerShell tool that executes caller-controlled commands as the Windows user running Windows-MCP, attackers could reach the control plane from arbitrary origins or non-browser clients and achieve arbitrary PowerShell execution. This issue was fixed in version 0.7.5.
A vulnerability in Windows-MCP versions prior to 0.7.5 allows for unauthenticated access to the MCP control plane via certain HTTP transport modes. This issue is compounded by wildcard Cross-Origin Resource Sharing (CORS) settings, which permit requests from any origin. The vulnerability arises because the same server exposes a PowerShell tool that executes commands controlled by the caller, using the Windows user account under which Windows-MCP is running. As a result, attackers can exploit this flaw to execute arbitrary PowerShell commands from any origin or non-browser client.
Users can upgrade to Windows-MCP version 0.7.5, which removes wildcard CORS by default, requires an authentication provider for HTTP transports, and adds DNS rebinding protection.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No CVSS 3.x data is available for this CVE.
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/CursorTouch/Windows-MCP/releases/tag/v0.7.5 | [email protected] | |
| https://github.com/CursorTouch/Windows-MCP/security/advisories/GHSA-vrxg-gm77-7q5g | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 18, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | New CVE Received | [email protected] |