{"data":{"id":"fc8b7495-aa45-492d-ad41-5e350423c2b2","title":"CVE-2026-54504: MCP Documentation Server is a local-first document management and semantic search server for AI coding agents. From…","summary":"MCP Documentation Server versions 1.13.0 through 1.13.1 start a Web UI by default on port 3080, and startWebServer in src/web-server.ts calls app.listen(PORT) without a host, binding the unauthenticated document-management API to all interfaces instead of localhost. A network-reachable client can call endpoints such as GET /api/documents, POST /api/documents, DELETE /api/documents/:id and POST /api/search-all without credentials to read, search, insert or delete documents and alter the assistant's knowledge base. The attacker must be able to reach the service over a LAN, VM network, container bridge, VPN or other routed network, and the issue does not grant remote code execution.","solution":"Fixed in 1.13.1.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54504","publishedAt":"2026-09-17T19:16:50.517Z","cveId":"CVE-2026-54504","cweIds":["CWE-306","CWE-668"],"cvssScore":"8.8","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["@andrea9293/mcp-documentation-server@= 1.13.0 (fixed: 1.13.1)"],"affectedPackageNames":["@andrea9293/mcp-documentation-server"],"affectedPackageRefs":["npm:@andrea9293/mcp-documentation-server"],"affectedVendors":[],"affectedVendorsRaw":["MCP Documentation Server"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"MCP Documentation Server Web UI exposes unauthenticated document API","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"adjacent","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00573,"epssCheckedAt":"2026-11-04T06:10:14.546Z","kevDateAdded":null,"advisoryAliases":["GHSA-6f5r-5672-72j7"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:43:39.693Z","patchAvailable":true,"disclosureDate":"2026-09-17T19:16:50.517Z","fixReleasedAt":"2026-06-04T21:13:33.543Z","daysToFix":-105,"fixCheckedAt":"2026-10-29T21:30:30.445Z","capecIds":["CAPEC-115"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"rag","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"@andrea9293/mcp-documentation-server","fixedVersion":"1.13.1","matchedVersion":"1.13.1","fixReleasedAt":"2026-06-04T21:13:33.543Z","daysToFix":-105,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:30:30.298Z"}]}}