Skip to content
OpenAdvisories

Package · npm

mcp-bridge

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • Critical 9.8
    GHSA-wvr4-3wq4-gpc5

    MCP Connect has unauthenticated remote OS command execution via /bridge endpoint

    ### Summary When _AUTH_TOKEN_ and _ACCESS_TOKEN_ environment variables are not set (which is the default out-of-the-box configuration) the _/bridge_ HTTP endpoint is completely unauthenticated. Any network-accessible caller can POST a request with an attacker…

    mcp-bridge npm