CVE-2026-62264— PDF Reader MCP: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY

Quick assessment

Affected

SylphxAI pdf-reader-mcp

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

PDF Reader MCP 是一个用于读取 PDF 文档的模型上下文协议（MCP）服务器。在 2.2.0 及之后、3.0.1 之前的版本中，当通过启用可选的 HTTP 服务器时，会读取环境变量并记录日志，声称已启用认证，但实际上并未对传入请求中的请求头进行验证。因此，端点会接受未经验证的客户端请求。由于默认绑定地址为，任何能够访问该端口的客户端均可调用所有 PDF 工具，并读取服务器进程在主机上可打开的任何 PDF 文件，尽管启动日志中错误地提示认证已启用。此外，基于 URL 的数据源还允许有限的服

CVSS 7.5 · High Updated Oct 31, 2026

Possible ATT&CK Techniques 3 AI

T1059.006 · Python T1071.001 · Web Protocols T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
SylphxAI	pdf-reader-mcp	`>= 2.2.0, < 3.0.1`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

PDF Reader MCP: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY

Source: CVE Program / CVE List V5

Vulnerability Description

PDF Reader MCP is a Model Context Protocol server for reading PDF documents. In versions 2.2.0 and later prior to 3.0.1, when `MCP_TRANSPORT=http` enables the opt-in HTTP server, `@sylphx/pdf-reader-mcp` reads `MCP_API_KEY` and logs that `X-API-Key` authentication is enabled but never validates the `X-API-Key` header on incoming requests. The `/mcp` endpoint consequently accepts unauthenticated clients. With the default bind address of `0.0.0.0`, any client able to reach the port can invoke every PDF tool and read any PDF the server process can open on the host, despite the misleading authentication-enabled startup log. URL-based sources additionally permit limited server-side request forgery; private and loopback destinations are blocked by default unless `--allow-private-ips` is set. The default `stdio` transport is unaffected. This issue is fixed in version 3.0.1.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

信息暴露

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
SylphxAI	pdf-reader-mcp	>= 2.2.0, < 3.0.1	-

II. Public POCs for CVE-2026-62264

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-62264

请登录查看更多情报信息。

Other References for CVE-2026-62264 (4)

https://github.com/SylphxAI/anymd/pull/332 x_refsource_MISC
https://github.com/SylphxAI/anymd/tree/v3.0.1 x_refsource_MISC
https://github.com/SylphxAI/anymd/security/advisories/GHSA-q344-5v34-gm84 x_refsource_CONFIRM
https://github.com/SylphxAI/anymd/commit/4c35f72862d729301e3912ab8c8317d2828cf4c2 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-62264

IV. Related Vulnerabilities

Same weakness: CWE-200