CVE-2026-54504: 
JavaScript 脆弱性の分析と軽減

CVE-2026-54504 is a missing authentication and unsafe network binding vulnerability in the npm package @andrea9293/mcp-documentation-server v1.13.0. The Web UI/API, which starts automatically by default on port 3080, binds to all network interfaces (0.0.0.0:3080) instead of localhost only, and exposes document-management API endpoints without any authentication requirement. This allows any network-reachable client on the same LAN, VM network, or container bridge to perform unauthenticated document-admin operations. The vulnerability was reported by researcher mcfly-zzh, published to the GitHub Advisory Database on July 15, 2026, and carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory).

The root cause is a combination of CWE-306 (Missing Authentication for Critical Function) and CWE-668 (Exposure of Resource to Wrong Sphere). In src/web-server.ts, the Express application calls app.listen(PORT) without specifying a host argument; in Node.js/Express, omitting the host causes the server to bind to all interfaces (0.0.0.0) by default rather than 127.0.0.1. The Web UI starts automatically unless the environment variable START_WEB_UI is explicitly set to false, and none of the exposed REST API endpoints (GET /api/documents, GET /api/documents/:id, POST /api/documents, POST /api/search-all, DELETE /api/documents/:id, GET /api/config) enforce any authentication check. A full proof-of-concept Python script was included in the advisory demonstrating unauthenticated enumeration, insertion, reading, searching, and deletion of documents via the host's LAN IP (GitHub Advisory, Security Advisory).

A network-adjacent unauthenticated attacker can fully read, search, insert, and delete documents stored in the MCP documentation server's knowledge base without any credentials. This affects confidentiality (full document content disclosure), integrity (attacker-controlled documents can be injected into the corpus used by the MCP assistant, potentially poisoning AI-assisted workflows), and availability (documents can be deleted). Users running the server on laptops, workstations, development VMs, or hosts connected to shared networks, VPNs, or Docker bridges are all at risk; the advisory explicitly notes this does not constitute remote code execution (GitHub Advisory).

A public proof-of-concept Python script is included in the official security advisory and requires no special tools or privileges — only network adjacency to the target host. No authentication header is needed; standard HTTP requests to port 3080 are sufficient. There is no evidence of in-the-wild exploitation or threat actor attribution at this time, and the CVE status remains Reserved. The vulnerability is detected by Qualys cloud security scanning (plugin 444850) and has been reviewed by Tenable (GitHub Advisory, GitLab Advisory).

1. Reconnaissance: Identify hosts on the local network running @andrea9293/mcp-documentation-server v1.13.0 by scanning for open TCP port 3080 using a tool such as nmap -p 3080 <subnet>.
2. Confirm exposure: Send an unauthenticated HTTP GET request to /api/config on the target's LAN IP: curl -sS http://<LAN_IP>:3080/api/config. A JSON response (e.g., {"gemini_available":false,"embedding_model":"Xenova/all-MiniLM-L6-v2"}) confirms the service is exposed and unauthenticated.
3. Enumerate documents: Issue GET http://<LAN_IP>:3080/api/documents to list all stored document titles and IDs without credentials.
4. Read document contents: Retrieve full content of any document via GET http://<LAN_IP>:3080/api/documents/<id>.
5. Inject attacker-controlled content: POST a malicious document to POST http://<LAN_IP>:3080/api/documents with a JSON body containing attacker-controlled title, content, and metadata fields, poisoning the knowledge base used by the MCP assistant.
6. Search corpus: Use POST http://<LAN_IP>:3080/api/search-all with a query payload to search across all stored documents.
7. Delete documents: Issue DELETE http://<LAN_IP>:3080/api/documents/<id> to destroy any document, causing availability impact (GitHub Advisory, Security Advisory).

• Network: Unexpected inbound HTTP connections to TCP port 3080 from non-localhost IP addresses; ss -ltnp | grep ':3080' showing LISTEN *:3080 instead of 127.0.0.1:3080.
• Logs: HTTP access logs for the Express server showing requests to /api/documents, /api/config, /api/search-all originating from LAN or external IPs without any Authorization header.
• File System: Unexpected or unfamiliar document entries in the MCP server's data directory (MCP_BASE_DIR) that were not added by the legitimate user, particularly documents with suspicious titles or attacker-controlled content markers.
• Process: Node.js process listening on 0.0.0.0:3080 (verifiable via ss -ltnp or netstat -tlnp) when the server is running with default configuration (GitHub Advisory).

Upgrade to @andrea9293/mcp-documentation-server v1.13.1, which binds the Web UI to 127.0.0.1 by default and introduces a new WEB_HOST environment variable (defaulting to 127.0.0.1) for explicit opt-in to network exposure (v1.13.1 Release, Fix Commit). As an immediate workaround on v1.13.0, set START_WEB_UI=false in the environment to disable the Web UI entirely, or use host-based firewall rules to block external access to TCP port 3080. If network exposure is required, set WEB_HOST=0.0.0.0 only after upgrading to v1.13.1 and implement network-level access controls.