A GitHub-reviewed advisory (GHSA-q344-5v34-gm84, CVE-2026-62264, CVSS 3.1 7.5) covers the MCP server @sylphx/pdf-reader-mcp, versions 2.2.0 to before 3.0.1.

• Bug: with MCP_TRANSPORT=http, the server read MCP_API_KEY and logged API key authentication enabled (X-API-Key header), but never checked the header on incoming requests, so /mcp accepted unauthenticated calls.
• Impact: the default bind address was 0.0.0.0, so any client that could reach the port could invoke every PDF tool and read any PDF the process could open on the host. URL sources also allowed limited SSRF (private and loopback addresses are blocked by default).
• Not affected: the default stdio transport.
• Fix: 3.0.1 enforces the key with a constant-time comparison (401 on a missing or wrong key), binds to 127.0.0.1 by default, and warns when binding a non-loopback host without a key.

What to do: upgrade to 3.0.1. If you can't, set MCP_HTTP_HOST=127.0.0.1, put an authenticating reverse proxy in front, switch to stdio, and limit file reach with --allow-dir / MCP_PDF_ALLOWED_DIRS. The broader lesson for MCP servers: a startup log saying auth is on is not proof; send a request without the key and confirm you get a 401.