mcp-router CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

CRITICAL mcp-router CVE published 2026-08-27

CVE-2026-81094

The mcp-router CLI served its MCP aggregator on every interface and enforced authentication only when the operator asked for it. Release 0.6.3 defaults the host to the loopback address and refuses to start without a token whenever the host it is given is not a loopback address. This vulnerability allows unauthorized access to the MCP aggregator, which can be exploited by anyone able to reach the port. Def [truncated]