Missing authentication in x64dbg-MCP Server exposes debugger tools
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.
Summary
x64dbg-MCP Server by duty1g before 1.1 exposes all its MCP debugger tools over HTTP and SSE without authentication. It listens on 0.0.0.0 by default, so any unauthenticated network client that reaches the default port, 9094 for x64 or 9095 for x32, can run arbitrary x64dbg commands, attach to processes, read and write debuggee memory, and write files to arbitrary paths. The flaw is missing authentication for a critical function (CWE-306).
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.1, x64dbg-MCP Server exposes all MCP debugger tools over HTTP and SSE without authentication while listening on 0.0.0.0 by default. Any unauthenticated network client that can reach the default port, 9094 for x64 or 9095 for x32, can execute arbitrary x64dbg commands, attach to processes by PID, read and write debuggee memory, and write files to arbitrary paths. This issue is fixed in version 1.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade x64dbg-MCP Server to version 1.1, which fixes this issue.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA x64dbg-mcp-server (duty1g) Fixed in 1.1
Timeline
- 2026-10-10 Threatist record created from CVE-2026-107824
- 2026-10-14 CISA SSVC decision points changed
References
Other 6
- https://github.com/duty1g/x64dbg-mcp-server/security/advisories/GHSA-4478-h5jv-647m
- https://github.com/duty1g/x64dbg-mcp-server/security/advisories/GHSA-jgj3-97w2-9v9r
- https://github.com/duty1g/x64dbg-mcp-server/commit/1aad0f88b9c27233d11dbccf08ca415eb5f49203
- https://github.com/duty1g/x64dbg-mcp-server/commit/e1daba0038959f88d25ff3376b2a7f922ffeb448
- https://github.com/duty1g/x64dbg-mcp-server/releases/tag/1.0
- https://github.com/duty1g/x64dbg-mcp-server/releases/tag/v1.1
More duty1g vulnerabilities
- TI-2026-70110 x64dbg-MCP Server pre-authentication DoS via Content-Length integer overflow CVSS 3.1MEDIUM 5.3
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences