CVE-2026-81094

CVE-2026-81094 is a missing-authentication flaw (CWE-306) in the mcp-router CLI: the serve command in apps/cli/src/commands/serve.ts defaults its host to the all-interfaces address on a fixed port and only requires an access token when the operator explicitly supplies one. A default invocation therefore exposes the MCP aggregator, and every MCP server it fronts, to anyone able to reach that port. An attacker gains unauthenticated access to those backed services, with high confidentiality and integrity impact per the CVSS 4.0 score of 9.3, though no availability impact is scored. Anyone running mcp-router CLI releases before 0.6.3 is affected, especially operators who ran serve with defaults where the port is reachable from other hosts. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is known; EPSS estimates roughly a 0.4 percent probability of exploitation within 30 days.

What to do: Upgrade to mcp-router 0.6.3 or later, which defaults the host to loopback and refuses to start without a token when bound to a non-loopback address. If upgrading is not possible, explicitly bind serve to loopback (or a firewalled interface) and always supply a token. Audit whether the aggregator port was reachable from untrusted networks and review logs for unauthenticated access to the backed MCP servers.