CVE-2026-62264 Details
Description
PDF Reader MCP is a Model Context Protocol server for reading PDF documents. In versions 2.2.0 and later prior to 3.0.1, when `MCP_TRANSPORT=http` enables the opt-in HTTP server, `@sylphx/pdf-reader-mcp` reads `MCP_API_KEY` and logs that `X-API-Key` authentication is enabled but never validates the `X-API-Key` header on incoming requests. The `/mcp` endpoint consequently accepts unauthenticated clients. With the default bind address of `0.0.0.0`, any client able to reach the port can invoke every PDF tool and read any PDF the server process can open on the host, despite the misleading authentication-enabled startup log. URL-based sources additionally permit limited server-side request forgery; private and loopback destinations are blocked by default unless `--allow-private-ips` is set. The default `stdio` transport is unaffected. This issue is fixed in version 3.0.1.
A vulnerability exists in the Model Context Protocol server component of the PDF Reader MCP application, specifically in versions 2.2.0 through 3.0.0. When the HTTP transport is enabled, the application reads the MCP_API_KEY environment variable and logs that API key authentication is active. However, it fails to validate the X-API-Key header in incoming requests, leaving the /mcp endpoint open to unauthenticated clients. This issue is exacerbated by the default bind address of 0.0.0.0, which allows any client to access the server and invoke PDF tools, potentially leading to unauthorized access to sensitive information. The vulnerability also enables limited server-side request forgery, depending on the nature of the PDF sources used. The default stdio transport is not affected.
The vulnerability has been fixed in version 3.0.1 of the @sylphx/pdf-reader-mcp package. Users should upgrade to this version. For those who cannot upgrade immediately, it is recommended to bind the server to the loopback address (127.0.0.1), use a reverse proxy that enforces authentication, or restrict filesystem access with the --allow-dir option.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/SylphxAI/anymd/commit/4c35f72862d729301e3912ab8c8317d2828cf4c2 | [email protected] | Source CodeVendor |
| https://github.com/SylphxAI/anymd/pull/332 | [email protected] | Source CodeVendor |
| https://github.com/SylphxAI/anymd/security/advisories/GHSA-q344-5v34-gm84 | [email protected] | AdvisoryRemedyVendor |
| https://github.com/SylphxAI/anymd/tree/v3.0.1 | [email protected] | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-287 | Improper Authentication | [email protected] |
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SylphxAI PDF Reader MCP | >= 2.2.0, < 3.0.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |