CVE-2026-100868— Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridge
Quick assessment
Affected
penpot penpot
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Penpot 在 2.18.0 版本之前，在单用户模式下会将 MCP 服务器插件的 WebSocket 桥接绑定到所有网络接口，且未进行身份验证。处于相邻网络的未授权攻击者可以连接到 WebSocket 端口，伪装成 Penpot 浏览器插件，拦截任务载荷，并向 MCP 客户端返回伪造的结果。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| penpot | @penpot/mcp | ≤ 2.15.4 |
affected |
| penpot | penpot | < 2.18.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-100868
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridge
Source: CVE Program / CVE List V5
Vulnerability Description
Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return forged results to the MCP client.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1327
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| penpot | penpot | 0 ~ 2.18.0 | - |
|
| penpot | @penpot/mcp | 0 ~ 2.15.4 | - |
|
II. Public POCs for CVE-2026-100868
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-100868
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-100868 (1)
Vendor Advisories for CVE-2026-100868 (3)
Other References for CVE-2026-100868 (1)
IV. Related Vulnerabilities
Same product: penpot
-
CVE-2026-47665
Penpot: Stored XSS via comment content, innerHTML renders un -
CVE-2026-47666
Penpot: Stored XSS via custom font family name injected into -
CVE-2026-17613
CVE-2026-17613 -
CVE-2026-45805
Penpot: MCP REPL server binds to 0.0.0.0 with unauthenticate -
CVE-2026-44986
Penpot: Pre-authenticated account takeover via team-invitati
Same vendor: penpot
-
CVE-2026-47665
Penpot: Stored XSS via comment content, innerHTML renders un -
CVE-2026-47666
Penpot: Stored XSS via custom font family name injected into -
CVE-2026-17613
CVE-2026-17613 -
CVE-2026-45805
Penpot: MCP REPL server binds to 0.0.0.0 with unauthenticate -
CVE-2026-44986
Penpot: Pre-authenticated account takeover via team-invitati
Same weakness: CWE-1327
-
CVE-2026-75021
fastify-cli vulnerable to remote code execution via ignored -
CVE-2026-20212
Cisco Nexus 3000 and 9000 Series Switches Silicon One Hardwa -
CVE-2026-82456
argocd-mcp 0.8.0 Authentication Bypass via Unauthenticated H -
CVE-2026-72924
GitHub CLI: `gh codespace ports forward` exposes forwarded s -
CVE-2026-16713
IBM Documentation Offline is vulnerable to information discl
V. Comments for CVE-2026-100868
No comments yet