CVE-2026-54504

Overview

MCP Documentation Server versions 1.13.0 and 1.13.1 contain an insecure binding vulnerability where the local web UI and document management API default to binding to all network interfaces. This allows unauthenticated remote clients on the same network to access, read, search, insert, and delete sensitive documentation and tamper with the AI assistant's knowledge base. The issue matters because it exposes internal documentation management functions without requiring any authentication.

Description

MCP Documentation Server is a local-first document management and semantic search server for AI coding agents. From 1.13.0 until 1.13.1, the automatically started Web UI in src/server.ts calls startWebServer in src/web-server.ts with START_WEB_UI enabled by default and WEB_PORT set to 3080. startWebServer uses app.listen(PORT) without a host, which binds the unauthenticated document-management API to all interfaces rather than localhost. A network-reachable client can invoke GET /api/documents, GET /api/documents/:id, POST /api/documents, POST /api/search-all, DELETE /api/documents/:id, and GET /api/config without credentials to enumerate and read documents, search the corpus, insert or delete documents, and tamper with the MCP assistant's knowledge base. The service must be reachable from the attacker's LAN, VM network, container bridge, VPN, or another routed network, and the issue does not provide remote code execution. This issue is fixed in 1.13.1.

Impact

This vulnerability impacts the confidentiality and integrity of organization data stored within the documentation server. Remote unauthenticated attackers on a connected LAN, VPN, or bridge network can enumerate documents, read sensitive contents, and manipulate the AI assistant's knowledge base. While remote code execution is not directly provided, data tampering and unauthorized disclosure pose significant operational risks.

Remediation

Upgrade the MCP Documentation Server to version 1.13.1 or later where the issue is resolved. If upgrading immediately is not possible, restrict network access to the server using local firewall rules or ensure the web server explicitly binds only to the localhost interface.

Risk context

This vulnerability is rated as High severity with a CVSS v3 score of 8.8, indicating a critical need for attention due to the potential for unauthenticated data access and tampering across reachable networks.

Affected products

• MCP Documentation Server