CVE-2026-48989

Windows-MCP is an open-source project that integrates AI agents with Windows. In versions prior to 0.7.5, certain HTTP modes exposed the MCP control plane without authentication while enabling wildcard CORS (allow_origins=, allow_methods=, allow_headers=*). Because the same server also exposed a PowerShell tool that executes caller-controlled commands as the Windows user running Windows-MCP, attackers could reach the control plane from arbitrary origins or non-browser clients and achieve arbitrary PowerShell execution. This issue was fixed in version 0.7.5.

Windows-MCP is an open-source project that integrates AI agents with Windows. In versions prior to 0.7.5, certain HTTP modes exposed the MCP control plane without authentication while enabling wildcard CORS (allow_origins=, allow_methods=, allow_headers=*). Because the same server also exposed a PowerShell tool that executes caller-controlled commands as the Windows user running Windows-MCP, attackers could reach the control plane from arbitrary origins or non-browser clients and achieve arbitrary PowerShell execution. This issue was fixed in version 0.7.5.

HTTP transports expose unauthenticated PowerShell control with wildcard CORS

There is an issue in the SSE and Streamable HTTP transport modes. The default stdio mode is not affected, but the documented HTTP modes expose the MCP control plane without authentication and add wildcard CORS handling around it. The same server exposes the PowerShell tool, which executes caller-controlled commands as the Windows user running Windows-MCP.

Relevant source:

• src/windows_mcp/__main__.py:37-42: _http_middleware() installs OptionsMiddleware and CORSMiddleware with allow_origins=["*"], allow_methods=["*"], and allow_headers=["*"].
• src/windows_mcp/__main__.py:45-72: OptionsMiddleware responds to every OPTIONS request with wildcard Access-Control-Allow-Origin, Access-Control-Allow-Methods, and Access-Control-Allow-Headers.
• src/windows_mcp/__main__.py:75-113: _build_mcp() constructs FastMCP(name="windows-mcp", ...) without an auth provider.
• src/windows_mcp/__main__.py:139-151: both sse and streamable-http call mcp.run(...) with that middleware and no application-level auth/security settings.
• src/windows_mcp/tools/shell.py:10-24: registers the PowerShell tool and passes caller-controlled command to PowerShellExecutor.execute_command.
• src/windows_mcp/desktop/powershell.py:176-204: executes that command through PowerShell -EncodedCommand.
• README.md:421-424 and 433-434: documents the HTTP transports and describes Streamable HTTP as network-accessible HTTP streaming.

In an affected configuration, a client that can reach http://localhost:8000/mcp can initialize an MCP session and invoke tools/call for PowerShell. The issue is not just that PowerShell is powerful; it is that the HTTP control plane around that tool is unauthenticated and configured with wildcard CORS.

Root cause

The HTTP transport entry points compose two independent design decisions that fail-open together: the FastMCP instance is built without any authentication provider, and the middleware stack installs blanket wildcard CORS (allow_origins=*, allow_methods=*, allow_headers=*) that explicitly permits cross-origin browsers and any non-browser HTTP client to reach the MCP control plane. Either one alone would be a partial defense; together, the unauthenticated control plane is reachable from arbitrary origins, with no host-validation, no token check, and no DNS-rebinding mitigation between an attacker's request and the registered PowerShell tool. The structural fix is to require an auth provider (token, mTLS, or local-only secret handshake) on the HTTP transports and to scope CORS to a specific operator-configured allowlist rather than applying wildcard policy to a tool surface that includes shell execution.

Auth boundary violated

Boundary: Network trust domain (an unauthenticated remote/cross-origin caller is treated as if it were a trusted local MCP client with rights to invoke privileged shell tools).

Respected at: stdio transport path (src/windows_mcp/__main__.py stdio branch) — the default transport relies on parent-process pipe ownership for caller identity, which is a real OS-level boundary.

Violated at: src/windows_mcp/__main__.py:139-151 (SSE and Streamable HTTP branches call mcp.run(...) with the wildcard-CORS middleware installed at :37-42 and no auth provider attached at :75-113). The boundary is silently dropped: there is no code path between the inbound HTTP request and tools/call for PowerShell (src/windows_mcp/tools/shell.py:10-24 → src/windows_mcp/desktop/powershell.py:176-204) that asserts caller identity or origin.

Minimal protocol proof from a matching FastMCP 3.2.4 harness with the same middleware posture:

$ curl -i -s -X OPTIONS 'http://127.0.0.1:18123/mcp/' \
  -H 'Origin: https://attacker.example' \
  -H 'Access-Control-Request-Method: POST' \
  -H 'Access-Control-Request-Headers: content-type,mcp-session-id'
…

Windows-MCP is an open-source project that integrates AI agents with Windows. In versions prior to 0.7.5, certain HTTP modes exposed the MCP control plane without authentication while enabling wildcard CORS (allow_origins=, allow_methods=, allow_headers=*). Because the same server also exposed a PowerShell tool that executes caller-controlled commands as the Windows user running Windows-MCP, attackers could reach the control plane from arbitrary origins or non-browser clients and achieve arbitrary PowerShell execution. This issue was fixed in version 0.7.5.

Windows-MCP is an open-source project that integrates AI agents with Windows. In versions prior to 0.7.5, certain HTTP modes exposed the MCP control plane without authentication while enabling wildcard CORS (allow_origins=, allow_methods=, allow_headers=*). Because the same server also exposed a PowerShell tool that executes caller-controlled commands as the Windows user running Windows-MCP, attackers could reach the control plane from arbitrary origins or non-browser clients and achieve arbitrary PowerShell execution. This issue was fixed in version 0.7.5.

HTTP transports expose unauthenticated PowerShell control with wildcard CORS

There is an issue in the SSE and Streamable HTTP transport modes. The default stdio mode is not affected, but the documented HTTP modes expose the MCP control plane without authentication and add wildcard CORS handling around it. The same server exposes the PowerShell tool, which executes caller-controlled commands as the Windows user running Windows-MCP.

Relevant source:

• src/windows_mcp/__main__.py:37-42: _http_middleware() installs OptionsMiddleware and CORSMiddleware with allow_origins=["*"], allow_methods=["*"], and allow_headers=["*"].
• src/windows_mcp/__main__.py:45-72: OptionsMiddleware responds to every OPTIONS request with wildcard Access-Control-Allow-Origin, Access-Control-Allow-Methods, and Access-Control-Allow-Headers.
• src/windows_mcp/__main__.py:75-113: _build_mcp() constructs FastMCP(name="windows-mcp", ...) without an auth provider.
• src/windows_mcp/__main__.py:139-151: both sse and streamable-http call mcp.run(...) with that middleware and no application-level auth/security settings.
• src/windows_mcp/tools/shell.py:10-24: registers the PowerShell tool and passes caller-controlled command to PowerShellExecutor.execute_command.
• src/windows_mcp/desktop/powershell.py:176-204: executes that command through PowerShell -EncodedCommand.
• README.md:421-424 and 433-434: documents the HTTP transports and describes Streamable HTTP as network-accessible HTTP streaming.

In an affected configuration, a client that can reach http://localhost:8000/mcp can initialize an MCP session and invoke tools/call for PowerShell. The issue is not just that PowerShell is powerful; it is that the HTTP control plane around that tool is unauthenticated and configured with wildcard CORS.

Root cause

The HTTP transport entry points compose two independent design decisions that fail-open together: the FastMCP instance is built without any authentication provider, and the middleware stack installs blanket wildcard CORS (allow_origins=*, allow_methods=*, allow_headers=*) that explicitly permits cross-origin browsers and any non-browser HTTP client to reach the MCP control plane. Either one alone would be a partial defense; together, the unauthenticated control plane is reachable from arbitrary origins, with no host-validation, no token check, and no DNS-rebinding mitigation between an attacker's request and the registered PowerShell tool. The structural fix is to require an auth provider (token, mTLS, or local-only secret handshake) on the HTTP transports and to scope CORS to a specific operator-configured allowlist rather than applying wildcard policy to a tool surface that includes shell execution.

Auth boundary violated

Boundary: Network trust domain (an unauthenticated remote/cross-origin caller is treated as if it were a trusted local MCP client with rights to invoke privileged shell tools).

Respected at: stdio transport path (src/windows_mcp/__main__.py stdio branch) — the default transport relies on parent-process pipe ownership for caller identity, which is a real OS-level boundary.

Violated at: src/windows_mcp/__main__.py:139-151 (SSE and Streamable HTTP branches call mcp.run(...) with the wildcard-CORS middleware installed at :37-42 and no auth provider attached at :75-113). The boundary is silently dropped: there is no code path between the inbound HTTP request and tools/call for PowerShell (src/windows_mcp/tools/shell.py:10-24 → src/windows_mcp/desktop/powershell.py:176-204) that asserts caller identity or origin.

Minimal protocol proof from a matching FastMCP 3.2.4 harness with the same middleware posture:

$ curl -i -s -X OPTIONS 'http://127.0.0.1:18123/mcp/' \
  -H 'Origin: https://attacker.example' \
  -H 'Access-Control-Request-Method: POST' \
  -H 'Access-Control-Request-Headers: content-type,mcp-session-id'
…

HTTP transports expose unauthenticated PowerShell control with wildcard CORS

There is an issue in the SSE and Streamable HTTP transport modes. The default stdio mode is not affected, but the documented HTTP modes expose the MCP control plane without authentication and add wildcard CORS handling around it. The same server exposes the PowerShell tool, which executes caller-controlled commands as the Windows user running Windows-MCP.

Relevant source:

• src/windows_mcp/__main__.py:37-42: _http_middleware() installs OptionsMiddleware and CORSMiddleware with allow_origins=["*"], allow_methods=["*"], and allow_headers=["*"].
• src/windows_mcp/__main__.py:45-72: OptionsMiddleware responds to every OPTIONS request with wildcard Access-Control-Allow-Origin, Access-Control-Allow-Methods, and Access-Control-Allow-Headers.
• src/windows_mcp/__main__.py:75-113: _build_mcp() constructs FastMCP(name="windows-mcp", ...) without an auth provider.
• src/windows_mcp/__main__.py:139-151: both sse and streamable-http call mcp.run(...) with that middleware and no application-level auth/security settings.
• src/windows_mcp/tools/shell.py:10-24: registers the PowerShell tool and passes caller-controlled command to PowerShellExecutor.execute_command.
• src/windows_mcp/desktop/powershell.py:176-204: executes that command through PowerShell -EncodedCommand.
• README.md:421-424 and 433-434: documents the HTTP transports and describes Streamable HTTP as network-accessible HTTP streaming.

In an affected configuration, a client that can reach http://localhost:8000/mcp can initialize an MCP session and invoke tools/call for PowerShell. The issue is not just that PowerShell is powerful; it is that the HTTP control plane around that tool is unauthenticated and configured with wildcard CORS.

Root cause

The HTTP transport entry points compose two independent design decisions that fail-open together: the FastMCP instance is built without any authentication provider, and the middleware stack installs blanket wildcard CORS (allow_origins=*, allow_methods=*, allow_headers=*) that explicitly permits cross-origin browsers and any non-browser HTTP client to reach the MCP control plane. Either one alone would be a partial defense; together, the unauthenticated control plane is reachable from arbitrary origins, with no host-validation, no token check, and no DNS-rebinding mitigation between an attacker's request and the registered PowerShell tool. The structural fix is to require an auth provider (token, mTLS, or local-only secret handshake) on the HTTP transports and to scope CORS to a specific operator-configured allowlist rather than applying wildcard policy to a tool surface that includes shell execution.

Auth boundary violated

Boundary: Network trust domain (an unauthenticated remote/cross-origin caller is treated as if it were a trusted local MCP client with rights to invoke privileged shell tools).

Respected at: stdio transport path (src/windows_mcp/__main__.py stdio branch) — the default transport relies on parent-process pipe ownership for caller identity, which is a real OS-level boundary.

Violated at: src/windows_mcp/__main__.py:139-151 (SSE and Streamable HTTP branches call mcp.run(...) with the wildcard-CORS middleware installed at :37-42 and no auth provider attached at :75-113). The boundary is silently dropped: there is no code path between the inbound HTTP request and tools/call for PowerShell (src/windows_mcp/tools/shell.py:10-24 → src/windows_mcp/desktop/powershell.py:176-204) that asserts caller identity or origin.

Minimal protocol proof from a matching FastMCP 3.2.4 harness with the same middleware posture:

$ curl -i -s -X OPTIONS 'http://127.0.0.1:18123/mcp/' \
  -H 'Origin: https://attacker.example' \
  -H 'Access-Control-Request-Method: POST' \
  -H 'Access-Control-Request-Headers: content-type,mcp-session-id'
…