---
title: pdf-reader-mcp CVE-2026-62264: HTTP mode logged that API-key auth was on but never checked the key | ctxsec
url: https://ctxsec.com/items/pdf-reader-mcp-cve-2026-62264-http-api-key-never-enforced
description: "@sylphx/pdf-reader-mcp 2.2.0 up to 3.0.0, when run with the opt-in HTTP transport, read MCP_API_KEY and logged that authentication was enabled but never validated the X-API-Key header. With the default 0.0.0.0 bind, anyone who could reach the port could call every tool and read any PDF the process could open. Fixed in 3.0.1 (CVSS 7.5)."
status: "official (GitHub-reviewed advisory GHSA-q344-5v34-gm84, Oct 29)"
published: 2026-10-31
---

> @sylphx/pdf-reader-mcp 2.2.0 up to 3.0.0, when run with the opt-in HTTP transport, read MCP_API_KEY and logged that authentication was enabled but never validated the X-API-Key header. With the default 0.0.0.0 bind, anyone who could reach the port could call every tool and read any PDF the process could open. Fixed in 3.0.1 (CVSS 7.5).

[← Context & Harness Attacks](/context) · [markdown](/items/pdf-reader-mcp-cve-2026-62264-http-api-key-never-enforced.md)

official (GitHub-reviewed advisory GHSA-q344-5v34-gm84, Oct 29)

2026-10-31

### pdf-reader-mcp CVE-2026-62264: HTTP mode logged that API-key auth was on but never checked the key

A GitHub-reviewed advisory (**GHSA-q344-5v34-gm84**, **CVE-2026-62264**, CVSS 3.1 **7.5**) covers the MCP server `@sylphx/pdf-reader-mcp`, versions **2.2.0 to before 3.0.1**.

- **Bug:** with `MCP_TRANSPORT=http`, the server read `MCP_API_KEY` and logged _API key authentication enabled (X-API-Key header)_, but never checked the header on incoming requests, so `/mcp` accepted unauthenticated calls.
- **Impact:** the default bind address was `0.0.0.0`, so any client that could reach the port could invoke every PDF tool and read any PDF the process could open on the host. URL sources also allowed limited SSRF (private and loopback addresses are blocked by default).
- **Not affected:** the default `stdio` transport.
- **Fix:** 3.0.1 enforces the key with a constant-time comparison (401 on a missing or wrong key), binds to `127.0.0.1` by default, and warns when binding a non-loopback host without a key.

**What to do:** upgrade to 3.0.1. If you can't, set `MCP_HTTP_HOST=127.0.0.1`, put an authenticating reverse proxy in front, switch to `stdio`, and limit file reach with `--allow-dir` / `MCP_PDF_ALLOWED_DIRS`. The broader lesson for MCP servers: a startup log saying auth is on is not proof; send a request without the key and confirm you get a 401.

Sources: [GitHub advisory GHSA-q344-5v34-gm84 / CVE-2026-62264 (Oct 29)](https://github.com/advisories/GHSA-q344-5v34-gm84) · [Fix: SylphxAI/anymd v3.0.1 release](https://github.com/SylphxAI/anymd/releases/tag/v3.0.1)