Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-81098— Telnyx MCP Server through 6.83.0 Missing Authentication on Streamable HTTP Transport

Quick assessment

Affected
team-telnyx telnyx-mcp
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

telnyx是美国telnyx组织的一个提供全球通信API的云平台。 telnyx 6.83.0及之前版本存在授权问题漏洞，该漏洞源于HTTP传输暴露在所有接口且未要求调用者凭证，可能导致未经身份验证的攻击者利用服务器存储的Telnyx API密钥和客户端密钥等凭证。

CVSS 9.1 · Critical EPSS 0.73% · P53

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
team-telnyx telnyx-mcp ≤ 6.83.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-81098

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Telnyx MCP Server through 6.83.0 Missing Authentication on Streamable HTTP Transport
Source: CVE Program / CVE List V5
Vulnerability Description
The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller credential. packages/mcp-server/src/http.ts served MCP on the root path with a listener bound to all interfaces and parsed the caller's authentication headers in a mode that did not fail when they were absent, so a request without any credential completed initialisation and dispatched tools. Dispatch forwarded the server's own stored credentials, the Telnyx API key and client secret together with the code-execution key, to the upstream endpoint, so an unauthenticated caller able to reach the port acted with them. The current code defaults the host to loopback, requires a server API key, and enforces it in middleware.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
telnyx 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
telnyx是美国telnyx组织的一个提供全球通信API的云平台。 telnyx 6.83.0及之前版本存在授权问题漏洞，该漏洞源于HTTP传输暴露在所有接口且未要求调用者凭证，可能导致未经身份验证的攻击者利用服务器存储的Telnyx API密钥和客户端密钥等凭证。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
team-telnyx telnyx-mcp 0 ~ 6.83.0 -

II. Public POCs for CVE-2026-81098

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-81098

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-81098 (2)

Vendor Pages for CVE-2026-81098 (1)

IV. Related Vulnerabilities

Same weakness: CWE-306

V. Comments for CVE-2026-81098

No comments yet

Leave a comment