The server read an API key setting and logged that protection was enabled, but the request handler never checked the presented header. A reachable caller could therefore invoke PDF tools using the server process access, potentially reading local documents. The risk applies to HTTP transport and reachable deployments, not every stdio installation; optional…
Inspect the ClaimsCase · DiggingBeagle record
PDF Reader MCP exposed document tools despite a configured API key
GitHub advisory GHSA-q344-5v34-gm84 says @sylphx/pdf-reader-mcp versions 2.2.0 before 3.0.1 accepted unauthenticated HTTP /mcp requests even when MCP_API_KEY was set.
Scope
Affected transport and reachability required; no real victim count, and the standard URL loader blocks private addresses unless configured otherwise.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
The project advisory reports that an HTTP MCP endpoint accepted requests even when the configuration claimed API-key enforcement, with version 3.0.1 addressing the missing check. Exposed network transport is required; stdio use is not equivalent. Impact remains unrated because the evidence does not supply a calibrated scale for this Case.
Assessed Nov 1, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-2026-NOV01-PDF-MCP-API-KEY-BYPASS-1 · GitHub security advisory GHSA-q344-5v34-gm84 for PDF Reader MCP
At a glance
Assess the reported tool or model action separately from the side effect actually observed.
Read the implicationsAffected transport and reachability required; no real victim count, and the standard URL loader blocks private addresses unless configured otherwise.
Limits and uncertaintyFull account
The server read an API key setting and logged that protection was enabled, but the request handler never checked the presented header. A reachable caller could therefore invoke PDF tools using the server process access, potentially reading local documents. The risk applies to HTTP transport and reachable deployments, not every stdio installation; optional private-IP access also changes possible URL-target risk.
Mechanism and trust boundary
- 01
Step
Claims & evidence
CLM-2026-NOV01-PDF-MCP-API-KEY-BYPASS-1GitHub advisory GHSA-q344-5v34-gm84 says @sylphx/pdf-reader-mcp versions 2.2.0 before 3.0.1 accepted unauthenticated HTTP /mcp requests even when MCP_API_KEY was set.supported
Basis: reported finding
- supportsGitHub security advisory GHSA-q344-5v34-gm84 for PDF Reader MCPprimary disclosure
GHSA-q344-5v34-gm84, Affected versions, Impact and patched 3.0.1
Implications
Assess the reported tool or model action separately from the side effect actually observed.
Controls and mitigations
- Upgrade to version 3.0.1 or later, restrict network binding and check actual unauthorized /mcp requests rather than relying on a startup log message.
Unknowns and contradictions
- Affected transport and reachability required; no real victim count, and the standard URL loader blocks private addresses unless configured otherwise.
Sources and citation
Material revision history
- Nov 1, 2026 · Canonical change recorded · new in release · revision 211