MCP Documentation Server: Web UI API binds to all interfaces without authentication by default

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-54504 · Microsoft / collected KEV context

EUVD-2026-82392

GHSA-6f5r-5672-72j7

cve-program · CVE-2026-54504

• https://github.com/andrea9293/mcp-documentation-server/security/advisories/GHSA-6f5r-5672-72j7
• https://github.com/andrea9293/mcp-documentation-server/pull/20
• https://github.com/andrea9293/mcp-documentation-server/commit/37159d4e06b8ee50c3645b2496e3d3f6d32c47f9
• https://github.com/andrea9293/mcp-documentation-server/releases/tag/v1.13.1

euvd · EUVD-2026-82392

• https://github.com/andrea9293/mcp-documentation-server/security/advisories/GHSA-6f5r-5672-72j7
• https://github.com/andrea9293/mcp-documentation-server/pull/20
• https://github.com/andrea9293/mcp-documentation-server/commit/37159d4e06b8ee50c3645b2496e3d3f6d32c47f9
• https://github.com/andrea9293/mcp-documentation-server/releases/tag/v1.13.1

nvd · CVE-2026-54504

• https://github.com/andrea9293/mcp-documentation-server/commit/37159d4e06b8ee50c3645b2496e3d3f6d32c47f9
• https://github.com/andrea9293/mcp-documentation-server/pull/20
• https://github.com/andrea9293/mcp-documentation-server/releases/tag/v1.13.1
• https://github.com/andrea9293/mcp-documentation-server/security/advisories/GHSA-6f5r-5672-72j7

osv · GHSA-6f5r-5672-72j7

• https://github.com/andrea9293/mcp-documentation-server/security/advisories/GHSA-6f5r-5672-72j7
• https://github.com/andrea9293/mcp-documentation-server/commit/37159d4e06b8ee50c3645b2496e3d3f6d32c47f9
• https://github.com/andrea9293/mcp-documentation-server
• https://github.com/andrea9293/mcp-documentation-server/releases/tag/v1.13.1

No related operational record is retained in the current change model.