HIGH 7.5 GitHub
CVE-2026-62264
@sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY
### Impact
When `@sylphx/pdf-reader-mcp` is run as an HTTP server (`MCP_TRANSPORT=http`), it reads the `MCP_API_KEY` environment variable and logs `API key authentication enabled (X-API-Key header)` at startup, but it never validated the `X-API-Key` header on incoming requests. The key was read into a variable and never enforced on the request path.
As a result, the `/mcp` endpoint accepted **unauthenticated** requests. Combined with the default bind address of `0.0.0.0` (all interfaces), any
Affected Products
- npm/@sylphx/pdf-reader-mcp >= 2.2.0, < 3.0.1
References
- https://github.com/advisories/GHSA-q344-5v34-gm84
- https://github.com/SylphxAI/pdf-reader-mcp/security/advisories/GHSA-q344-5v34-gm84
- https://github.com/SylphxAI/anymd/pull/332
- https://github.com/SylphxAI/anymd/commit/4c35f72862d729301e3912ab8c8317d2828cf4c2
This high severity vulnerability with a CVSS score of 7.5 was published on 2026-10-29 via GitHub. Affected: npm/@sylphx/pdf-reader-mcp >= 2.2.0, < 3.0.1.
vulnfeed aggregates 16884 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.