MCP Documentation Server: Web UI API binds to all interfaces without authentication by default

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-54504 · CVE overview and exploitation status

EUVD-2026-82392

GHSA-6f5r-5672-72j7

cve-program · CVE-2026-54504

• https://github.com/andrea9293/mcp-documentation-server/security/advisories/GHSA-6f5r-5672-72j7
• https://github.com/andrea9293/mcp-documentation-server/pull/20
• https://github.com/andrea9293/mcp-documentation-server/commit/37159d4e06b8ee50c3645b2496e3d3f6d32c47f9
• https://github.com/andrea9293/mcp-documentation-server/releases/tag/v1.13.1

euvd · EUVD-2026-82392

• https://github.com/andrea9293/mcp-documentation-server/security/advisories/GHSA-6f5r-5672-72j7
• https://github.com/andrea9293/mcp-documentation-server/pull/20
• https://github.com/andrea9293/mcp-documentation-server/commit/37159d4e06b8ee50c3645b2496e3d3f6d32c47f9
• https://github.com/andrea9293/mcp-documentation-server/releases/tag/v1.13.1

nvd · CVE-2026-54504

• https://github.com/andrea9293/mcp-documentation-server/commit/37159d4e06b8ee50c3645b2496e3d3f6d32c47f9
• https://github.com/andrea9293/mcp-documentation-server/pull/20
• https://github.com/andrea9293/mcp-documentation-server/releases/tag/v1.13.1
• https://github.com/andrea9293/mcp-documentation-server/security/advisories/GHSA-6f5r-5672-72j7

osv · GHSA-6f5r-5672-72j7

• https://github.com/andrea9293/mcp-documentation-server/security/advisories/GHSA-6f5r-5672-72j7
• https://github.com/andrea9293/mcp-documentation-server/commit/37159d4e06b8ee50c3645b2496e3d3f6d32c47f9
• https://github.com/andrea9293/mcp-documentation-server
• https://github.com/andrea9293/mcp-documentation-server/releases/tag/v1.13.1

No related changes are available here.