Case · DiggingBeagle record
Before version 0.7.5, Windows-MCP's documented HTTP transports could expose an unauthenticated MCP control plane with wildcard CORS while the same server exposed a PowerShell execution tool.
Windows-MCP SSE and Streamable HTTP transport modes before 0.7.5. The default stdio transport was not affected by the advisory.
Windows-MCP is designed to give agents direct control over Windows features, including PowerShell. The May 2026 advisory found that the HTTP transport modes combined that authority with weak transport assumptions: wildcard CORS, no authentication on the MCP control plane and no Host validation against DNS rebinding.
This created a direct path from an untrusted browser origin or network client to privileged agent tools. The PowerShell tool made the impact concrete because caller-controlled commands execute under the Windows account running the server.
Version 0.7.5 changed the defaults: wildcard CORS was removed, trusted origins became explicit and host validation was added. The case is useful because the dangerous primitive was intentional; the vulnerability was the missing boundary around it.
The operator starts SSE or Streamable HTTP transport.
Boundary: local or network service / MCP transport
Wildcard CORS and missing authentication allow requests to reach privileged tools.
Boundary: browser or client / MCP control plane
A caller supplies a command to the exposed tool.
Boundary: MCP request / PowerShell
The command runs with the privileges of the Windows account hosting Windows-MCP.
Boundary: tool / operating system
GHSA-vrxg-gm77-7q5g describes the HTTP transport issue.
The release changes CORS defaults and adds host validation.
Locator: Advisory description
The advisory identifies unauthenticated HTTP control and wildcard CORS in SSE and Streamable HTTP modes.
Locator: Security fix
The 0.7.5 release notes describe CORS opt-in and TrustedHostMiddleware-based host validation.
Locator: Advisory scope
The issue is scoped to documented HTTP transport modes.
Locator: Advisory description
The advisory links control-plane exposure to a PowerShell execution capability.
diagram
Browser origin or reachable network client
SSE or Streamable HTTP in affected versions
No application authentication in affected configuration
Caller-controlled command
Command executes as server user
MCP servers should be reviewed as privileged service endpoints, not treated as harmless glue. A tool that intentionally provides shell, filesystem or UI control requires transport authentication, origin constraints, host validation and deployment guidance that matches the authority of the tool set.
DiggingBeagle. “Windows-MCP HTTP modes exposed PowerShell behind a weak control plane.” First seen May 14, 2026. https://diggingbeagle.com/cases/windows-mcp-http-modes-exposed-powershell-behind-a-weak-control-plane/
Citation guidanceWhy this archive exists
DiggingBeagle is a non profit research project documenting AI security incidents, agent failures, vulnerabilities and AI-assisted operations. A case keeps its claims beside the sources that support, contest or limit them. Later updates stay visible, so a reader can see when the account changed.
We publish case reconstructions, dated reporting and analysis across records. Each has a different evidentiary role. About the project and our methodology explain how the work is reviewed.