CVE-2026-55605 Details
Description
DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.8.0, the self-hosted HTTP transport of `@arikusi/deepseek-mcp-server` exposes `POST /mcp` without any authentication: `createMcpExpressApp` is called without an `authProvider` and no middleware guards the route, so any network-reachable client can issue an unauthenticated `initialize` request and obtain a valid MCP session identifier. In reproduced testing against commit `5e1302171e99`, an unauthenticated client was able to initialize a session, enumerate tools, and invoke the local `deepseek_sessions` tool with no credentials. The same unauthenticated session also exposes `deepseek_chat`, whose handler uses the server-side `DEEPSEEK_API_KEY` when self-hosted deployments configure one. This issue applies to self-hosted HTTP mode, not the separately documented hosted BYOK endpoint in `README.md`, which expects an `Authorization: Bearer ...` header. Upstream self-hosted container assets enable HTTP mode by default (`Dockerfile`) and publish port `3000` (`docker-compose.yml`). Version 1.8.0 contains a patch for this issue.
A vulnerability exists in DeepSeek MCP Server versions 1.4.2 prior to 1.8.0, where the self-hosted HTTP transport exposes the POST /mcp endpoint without authentication. This allows any network-reachable client to send an unauthenticated initialize request and receive a valid MCP session identifier. The vulnerability was tested in version 1.7.0, where an unauthenticated client could initialize a session, enumerate tools, and invoke the deepseek_sessions tool without credentials. Additionally, the deepseek_chat tool was accessible, using the server-side DEEPSEEK_API_KEY if configured. This issue does not affect the hosted BYOK endpoint, which requires an Authorization: Bearer header.
To address this vulnerability, authentication should be required on the self-hosted HTTP endpoint before creating MCP sessions. This can be done by passing an authProvider to the createMcpExpressApp function or by adding authentication middleware or a reverse proxy in front of the /mcp endpoint. For deployments that only need local access, the HTTP transport can be bound to 127.0.0.1 instead of 0.0.0.0.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 9, 2026CISA-ADP
Assessed Jul 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/arikusi/deepseek-mcp-server/security/advisories/GHSA-72f3-6w86-7rv3 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/arikusi/deepseek-mcp-server/blob/main/CHANGELOG.md#180---2026-06-14 | [email protected] | Release NotesVendor |
| https://github.com/arikusi/deepseek-mcp-server/releases/tag/v1.8.0 | [email protected] | Release NotesVendor |
| https://github.com/arikusi/deepseek-mcp-server/security/advisories/GHSA-72f3-6w86-7rv3 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Arikusi DeepSeek MCP Server | >= 1.4.2, < 1.8.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 10, 2026 | CVE Modified | CISA-ADP |
| Jul 9, 2026 | New CVE Received | [email protected] |