PDF Reader MCP HTTP transport skips API key validation
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure, Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200 and CWE-287.
Summary
PDF Reader MCP versions from 2.2.0 before 3.0.1, including the npm package @sylphx/pdf-reader-mcp, do not validate the X-API-Key header on the /mcp endpoint when MCP_TRANSPORT=http is enabled, even though MCP_API_KEY is configured and the startup log says authentication is enabled. This is missing authentication (CWE-306). With the default bind address of 0.0.0.0, an unauthenticated remote attacker who can reach the port can invoke every PDF tool and read any PDF the server process can open. The default stdio transport is not affected.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
Description from the CNA
PDF Reader MCP is a Model Context Protocol server for reading PDF documents. In versions 2.2.0 and later prior to 3.0.1, when `MCP_TRANSPORT=http` enables the opt-in HTTP server, `@sylphx/pdf-reader-mcp` reads `MCP_API_KEY` and logs that `X-API-Key` authentication is enabled but never validates the `X-API-Key` header on incoming requests. The `/mcp` endpoint consequently accepts unauthenticated clients. With the default bind address of `0.0.0.0`, any client able to reach the port can invoke every PDF tool and read any PDF the server process can open on the host, despite the misleading authentication-enabled startup log. URL-based sources additionally permit limited server-side request forgery; private and loopback destinations are blocked by default unless `--allow-private-ips` is set. The default `stdio` transport is unaffected. This issue is fixed in version 3.0.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SylphxAI | pdf-reader-mcp | 2.2.0 to before 3.0.1 | 3.0.1 | Patch available | CNA |
| — | @sylphx/pdf-reader-mcp (npm) | 2.2.0 to before 3.0.1 | 3.0.1 | Patch available | GHSA-q344-5v34-gm84 |
- pdf-reader-mcp VendorSylphxAI Affected 2.2.0 to before 3.0.1 Fixed in 3.0.1 Patch available CNA
- @sylphx/pdf-reader-mcp (npm) Vendor— Affected 2.2.0 to before 3.0.1 Fixed in 3.0.1 Patch available GHSA-q344-5v34-gm84
Remediation
Upgrade pdf-reader-mcp and @sylphx/pdf-reader-mcp to version 3.0.1 or later, which fixes the issue.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
- Fix · CNA pdf-reader-mcp (SylphxAI) Fixed in 3.0.1
- Fix · GHSA-q344-5v34-gm84 @sylphx/pdf-reader-mcp (npm) Fixed in 3.0.1 Advisory →
Timeline
- 2026-10-30 Threatist record created from CVE-2026-62264
- 2026-11-01 Priority changed: MEDIUM → LOW
- 2026-11-06 CISA SSVC decision points changed
References
Other 7
- https://github.com/SylphxAI/anymd/security/advisories/GHSA-q344-5v34-gm84
- https://github.com/SylphxAI/anymd/pull/332
- https://github.com/SylphxAI/anymd/commit/4c35f72862d729301e3912ab8c8317d2828cf4c2
- https://github.com/SylphxAI/anymd/tree/v3.0.1
- https://github.com/SylphxAI/pdf-reader-mcp/security/advisories/GHSA-q344-5v34-gm84
- https://github.com/SylphxAI/anymd/releases/tag/v3.0.1
- https://github.com/SylphxAI/pdf-reader-mcp
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences