CVE-2026-62264 SylphxAI CVE debrief

Who should care

Defenders responsible for systems using `@sylphx/pdf-reader-mcp` as an HTTP server should assess exposure and prioritize remediation. This includes verifying if the `MCP_API_KEY` is set but not enforced and updating to a fixed version.

Why it matters

CVE-2026-62264 allows unauthenticated requests to `@sylphx/pdf-reader-mcp` HTTP servers despite a configured API key, enabling access to PDF tools and contents. Defenders should verify exposure, especially in HTTP server deployments, and remediate by updating to `@sylphx/[email protected]` or later.

• Silent exposure due to misleading startup logs.
• Unauthenticated access to PDF tools and contents.
• Potential for SSRF with limited scope.
• Verification of API key authentication enforcement required.

Technical summary

The `@sylphx/pdf-reader-mcp` package does not validate the `X-API-Key` header for incoming requests when run as an HTTP server, despite logging that API key authentication is enabled. This allows unauthenticated access to the `/mcp` endpoint, enabling any client to invoke PDF tools and read PDF contents accessible by the server process. The exposure is silent due to a misleading startup log indicating API key authentication is enabled, which may lead defenders to believe the server is protected when it is not. This issue affects the opt-in HTTP transport; the default `stdio` transport is unaffected. A fix is available in `@sylphx/[email protected]`.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in their environments, especially where `@sylphx/pdf-reader-mcp` is used as an HTTP server.

Recommended defensive actions

• Verify if `@sylphx/pdf-reader-mcp` is used in your environment, especially as an HTTP server.
• Check if the `MCP_API_KEY` environment variable is set but not enforced.
• Update to `@sylphx/[email protected]` or later to enforce API key authentication.
• Monitor for unauthorized access to PDF files and tools.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The source corpus provides details on the vulnerability, its impact, and the fix. However, it does not provide information on exploitation or specific victims. The `@sylphx/pdf-reader-mcp` package, when run as an HTTP server, fails to validate the `X-API-Key` header despite reading and logging an `MCP_API_KEY` environment variable at startup. This results in the `/mcp` endpoint accepting unauthenticated requests, allowing any client able to reach the server to invoke PDF tools and read the contents of any PDF the server process can A

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.