High, CVSS 8.8npmAmendedPublished
@andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without authentication by default
CVE-2026-54504 · GHSA-6f5r-5672-72j7
- Affected
- npm @andrea9293/mcp-documentation-server >= 1.13.0, <= 1.13.0
- Fixed in
- 1.13.1· Vendor fix available
- Issue
- @andrea9293/mcp-documentation-server v1.13.0 documents that a Web UI starts automatically on port 3080. However, the Web UI/API appears to bind to all network interfaces by default (:3080 / 0.0.0.0:3080) instead of localhost-only, and its document-management API endpoints do not require authentication. As a result, any network-reachable client on the same LAN, VM network, or container bridge can access the document-admin API without credentials. In my reproduction, I was able to enumerate documents, add a document, read its full content, search across the corpus, and delete the document through the host's LAN IP. The issue is not that a Web UI exists. The issue is that a local document-management Web UI/API is exposed on all interfaces by default without authentication. Details The README documents that the Web UI starts automatically and tells users to open: It also documents STARTWEBUI=true and WEBPORT=3080 as the defaults. The vulnerable behavior appears to come from…
Recommended action: Upgrade to 1.13.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.