Unauthenticated MCP Requests Vulnerability in Gearboy Emulator by Dr. Helios

CVE-2026-61542

What is CVE-2026-61542?

The Gearboy emulator, which functions as a Game Boy and Game Boy Color emulator with an embedded MCP server, contains a flaw in the Gearsystem component. When configured with the optional --mcp-http mode, it allows unauthenticated MCP requests from any reachable network peer, contrary to the supposed localhost-only restrictions. This security issue arises due to a socket binding to INADDR_ANY on port 7777, which permits POST requests to the /mcp endpoint without necessary authorization or origin validation. This absence of proper checks exposes the emulator to potential misuse, allowing peers to initiate MCP sessions and trigger various emulator and debugging features without initial authentication. While access is constrained to the emulator process and local files treated as media, it poses a risk if exploited. A fix is included in Gearboy version 3.8.7.

References