CVE-2026-62264

PDF Reader MCP is a Model Context Protocol server for reading PDF documents. In versions 2.2.0 and later prior to 3.0.1, when MCP_TRANSPORT=http enables the opt-in HTTP server, @sylphx/pdf-reader-mcp reads MCP_API_KEY and logs that X-API-Key authentication is enabled but never validates the X-API-Key header on incoming requests. The /mcp endpoint consequently accepts unauthenticated clients. With the default bind address of 0.0.0.0, any client able to reach the port can invoke every PDF tool and read any PDF the server process can open on the host, despite the misleading authentication-enabled startup log. URL-based sources additionally permit limited server-side request forgery; private and loopback destinations are blocked by default unless --allow-private-ips is set. The default stdio transport is unaffected. This issue is fixed in version 3.0.1.

PDF Reader MCP is a Model Context Protocol server for reading PDF documents. In versions 2.2.0 and later prior to 3.0.1, when MCP_TRANSPORT=http enables the opt-in HTTP server, @sylphx/pdf-reader-mcp reads MCP_API_KEY and logs that X-API-Key authentication is enabled but never validates the X-API-Key header on incoming requests. The /mcp endpoint consequently accepts unauthenticated clients. With the default bind address of 0.0.0.0, any client able to reach the port can invoke every PDF tool and read any PDF the server process can open on the host, despite the misleading authentication-enabled startup log. URL-based sources additionally permit limited server-side request forgery; private and loopback destinations are blocked by default unless --allow-private-ips is set. The default stdio transport is unaffected. This issue is fixed in version 3.0.1.

Impact

When @sylphx/pdf-reader-mcp is run as an HTTP server (MCP_TRANSPORT=http), it reads the MCP_API_KEY environment variable and logs API key authentication enabled (X-API-Key header) at startup, but it never validated the X-API-Key header on incoming requests. The key was read into a variable and never enforced on the request path.

As a result, the /mcp endpoint accepted unauthenticated requests. Combined with the default bind address of 0.0.0.0 (all interfaces), any client able to reach the port could invoke every PDF tool and read the contents of any PDF the server process could open anywhere on the host. URL-based sources also enable limited SSRF (private/loopback addresses are blocked by default unless --allow-private-ips is set).

The misleading startup log made the exposure silent: an operator who set MCP_API_KEY reasonably believed the server was protected when it was not.

This affects only the opt-in HTTP transport; the default stdio transport is unaffected.

Patches

Fixed in @sylphx/[email protected]. The fix enforces the X-API-Key header with a constant-time comparison (rejecting missing/mismatched keys with HTTP 401), changes the default bind host to 127.0.0.1 (loopback), and emits a startup warning when binding a non-loopback host without an API key.

Workarounds

For deployments that cannot upgrade immediately:

• Bind to loopback only: MCP_HTTP_HOST=127.0.0.1.
• Place a reverse proxy in front that enforces authentication.
• Use the default stdio transport instead of HTTP.
• Restrict filesystem reach with --allow-dir / MCP_PDF_ALLOWED_DIRS.

Reported privately by novice-22 via responsible disclosure.

PDF Reader MCP is a Model Context Protocol server for reading PDF documents. In versions 2.2.0 and later prior to 3.0.1, when MCP_TRANSPORT=http enables the opt-in HTTP server, @sylphx/pdf-reader-mcp reads MCP_API_KEY and logs that X-API-Key authentication is enabled but never validates the X-API-Key header on incoming requests. The /mcp endpoint consequently accepts unauthenticated clients. With the default bind address of 0.0.0.0, any client able to reach the port can invoke every PDF tool and read any PDF the server process can open on the host, despite the misleading authentication-enabled startup log. URL-based sources additionally permit limited server-side request forgery; private and loopback destinations are blocked by default unless --allow-private-ips is set. The default stdio transport is unaffected. This issue is fixed in version 3.0.1.

PDF Reader MCP is a Model Context Protocol server for reading PDF documents. In versions 2.2.0 and later prior to 3.0.1, when MCP_TRANSPORT=http enables the opt-in HTTP server, @sylphx/pdf-reader-mcp reads MCP_API_KEY and logs that X-API-Key authentication is enabled but never validates the X-API-Key header on incoming requests. The /mcp endpoint consequently accepts unauthenticated clients. With the default bind address of 0.0.0.0, any client able to reach the port can invoke every PDF tool and read any PDF the server process can open on the host, despite the misleading authentication-enabled startup log. URL-based sources additionally permit limited server-side request forgery; private and loopback destinations are blocked by default unless --allow-private-ips is set. The default stdio transport is unaffected. This issue is fixed in version 3.0.1.

Impact

When @sylphx/pdf-reader-mcp is run as an HTTP server (MCP_TRANSPORT=http), it reads the MCP_API_KEY environment variable and logs API key authentication enabled (X-API-Key header) at startup, but it never validated the X-API-Key header on incoming requests. The key was read into a variable and never enforced on the request path.

As a result, the /mcp endpoint accepted unauthenticated requests. Combined with the default bind address of 0.0.0.0 (all interfaces), any client able to reach the port could invoke every PDF tool and read the contents of any PDF the server process could open anywhere on the host. URL-based sources also enable limited SSRF (private/loopback addresses are blocked by default unless --allow-private-ips is set).

The misleading startup log made the exposure silent: an operator who set MCP_API_KEY reasonably believed the server was protected when it was not.

This affects only the opt-in HTTP transport; the default stdio transport is unaffected.

Patches

Fixed in @sylphx/[email protected]. The fix enforces the X-API-Key header with a constant-time comparison (rejecting missing/mismatched keys with HTTP 401), changes the default bind host to 127.0.0.1 (loopback), and emits a startup warning when binding a non-loopback host without an API key.

Workarounds

For deployments that cannot upgrade immediately:

• Bind to loopback only: MCP_HTTP_HOST=127.0.0.1.
• Place a reverse proxy in front that enforces authentication.
• Use the default stdio transport instead of HTTP.
• Restrict filesystem reach with --allow-dir / MCP_PDF_ALLOWED_DIRS.

Reported privately by novice-22 via responsible disclosure.