Unauthenticated Access Vulnerability in PDF Reader MCP

CVE-2026-62264

What is CVE-2026-62264?

A security issue in PDF Reader MCP allows unauthenticated clients to access the /mcp endpoint. Due to a lack of validation for the X-API-Key header, clients can invoke PDF tools without proper authentication. This vulnerability particularly affects versions from 2.2.0 until 3.0.1, where the HTTP server is optionally enabled. Although misleading logs indicate authentication is enabled, the default behavior binds to 0.0.0.0, making the service accessible to anyone on the network. This flaw could lead to unintended exposure of sensitive PDF documents and potentially allow limited server-side request forgery unless specific configurations are applied.

References