CVE-2026-62264

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-62264
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62264.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-62264
Aliases
Published
2026-10-30T18:32:18Z
Modified
2026-10-31T10:46:13Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
PDF Reader MCP: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY
Details

PDF Reader MCP is a Model Context Protocol server for reading PDF documents. In versions 2.2.0 and later prior to 3.0.1, when MCP_TRANSPORT=http enables the opt-in HTTP server, @sylphx/pdf-reader-mcp reads MCP_API_KEY and logs that X-API-Key authentication is enabled but never validates the X-API-Key header on incoming requests. The /mcp endpoint consequently accepts unauthenticated clients. With the default bind address of 0.0.0.0, any client able to reach the port can invoke every PDF tool and read any PDF the server process can open on the host, despite the misleading authentication-enabled startup log. URL-based sources additionally permit limited server-side request forgery; private and loopback destinations are blocked by default unless --allow-private-ips is set. The default stdio transport is unaffected. This issue is fixed in version 3.0.1.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-200",
        "CWE-287",
        "CWE-306"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62264.json"
}
References

Affected packages

Git / github.com/sylphxai/anymd

Affected ranges

Type
GIT
Repo
https://github.com/sylphxai/anymd
Events
Introduced
bccf19f52bc094853def1677181f5e8547763cdd
Fixed
2eec9064a330cc40d302639ad14e8d53e1d85827
Fixed
4c35f72862d729301e3912ab8c8317d2828cf4c2
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "2.2.0"
                },
                {
                    "fixed":  "3.0.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "4c35f72862d729301e3912ab8c8317d2828cf4c2"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v2.*
v2.2.0
v2.3.0
v2.3.1
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.*
v3.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62264.json"