DIGGINGBEAGLE

Case · DiggingBeagle record

Windows-MCP HTTP modes exposed PowerShell behind a weak control plane

Before version 0.7.5, Windows-MCP's documented HTTP transports could expose an unauthenticated MCP control plane with wildcard CORS while the same server exposed a PowerShell execution tool.

MCP control-plane exposureLocalhost is not a trust boundary for agentsAgent authority
Scope

Windows-MCP SSE and Streamable HTTP transport modes before 0.7.5. The default stdio transport was not affected by the advisory.

Assessment profile

Assessment method
Setting
research demonstration
Exploitation
not established
Evidence
Grade B
Remediation
patch available
AI role
AGAINST AI
Basis and provenance

The maintainer advisory establishes unauthenticated HTTP control and a user-privileged PowerShell capability with a named patch. The default stdio path is unaffected; the record does not show an executed attack or independently verified comprehensive remediation. Assessment is a desk review of the retained canonical Claims and cited Source metadata at their recorded cutoff, not a new external verification. Impact remains ungraded.

Assessed Sep 24, 2026 using diggingbeagle.assessment/1.

Evidence basis: CLM-HTTP · CLM-PATCH · CLM-STDIO · CLM-POWERSHELL · Windows-MCP v0.7.5 security patch: CORS and DNS rebinding · HTTP transports expose unauthenticated PowerShell control with wildcard CORS

At a glance

Mechanism and trust boundary

  1. 01

    Expose Windows-MCP over HTTP

    The operator starts SSE or Streamable HTTP transport.

    Boundary: local or network service / MCP transport

  2. 02

    Reach control plane from an untrusted origin

    In affected HTTP modes, a reachable unauthenticated client can invoke privileged tools; browser access also depends on local-network enforcement.

    Boundary: browser or client / MCP control plane

  3. 03

    Invoke PowerShell tool

    A caller supplies a command to the exposed tool.

    Boundary: MCP request / PowerShell

  4. 04

    Execute under server user

    The command runs with the privileges of the Windows account hosting Windows-MCP.

    Boundary: tool / operating system

Timeline

  1. May 14, 2026
    Event type unspecified

    Maintainer publishes security advisory

    GHSA-vrxg-gm77-7q5g describes the HTTP transport issue.

  2. May 14, 2026
    mitigation

    Version 0.7.5 ships the security patch

    The release changes CORS defaults and adds host validation.

    CLM-PATCH

Claims & evidence

CLM-HTTPThe maintainer advisory reports that Windows-MCP HTTP transports before 0.7.5 exposed the MCP control plane without authentication and used wildcard CORS.supported

Basis: reported finding

Link to claim
CLM-PATCHWindows-MCP 0.7.5 removed wildcard CORS by default and added trusted-host checks intended to mitigate cross-origin and DNS-rebinding access.supported

Basis: reported finding

Link to claim
CLM-STDIOThe advisory states that the default stdio transport was not affected.supported

Basis: reported finding

Link to claim
CLM-POWERSHELLThe same server exposed a PowerShell tool that executed caller-controlled commands as the Windows user running Windows-MCP.supported

Basis: reported finding

Link to claim

Evidence visuals

diagram

Windows-MCP HTTP control-plane exposure

  1. Untrusted client

    Browser origin or reachable network client

  2. HTTP transport

    SSE or Streamable HTTP in affected versions

  3. MCP control plane

    No application authentication in affected configuration

  4. PowerShell tool

    Caller-controlled command

  5. Windows user context

    Command executes as server user

  • Untrusted client HTTP transport: request
  • HTTP transport MCP control plane: wildcard CORS / no auth
  • MCP control plane PowerShell tool: tools/call
  • PowerShell tool Windows user context: execution
Project-authored reconstruction from the GitHub advisory and version 0.7.5 release notes. · Source: Windows-MCP HTTP modes exposed PowerShell behind a weak control plane

Implications

MCP servers should be reviewed as privileged service endpoints, not treated as harmless glue. A tool that intentionally provides shell, filesystem or UI control requires transport authentication, origin constraints, host validation and deployment guidance that matches the authority of the tool set.

Controls and mitigations

  • Upgrade Windows-MCP to 0.7.5 or later.
  • Prefer stdio where remote HTTP transport is unnecessary.
  • Require authentication for privileged MCP endpoints.
  • Use explicit trusted origins rather than wildcard CORS.
  • Validate Host headers and defend local services against DNS rebinding.

Unknowns and contradictions

  • The cited advisory does not establish exploitation in the wild.
  • Exposure varies with transport mode, bind address and surrounding network controls.

Sources and citation

EvidenceHTTP transports expose unauthenticated PowerShell control with wildcard CORSEvidenceWindows-MCP v0.7.5 security patch: CORS and DNS rebinding

Material revision history

  1. Sep 16, 2026 · Published version · first publication · revision 1
  2. Sep 25, 2026 · Published version · material revision · revision 39Public fields changed: assessment_profile
  3. Oct 8, 2026 · Published version · material revision · revision 99Public fields changed: attack_path, claims, narrative
Record metadata

Canonical ID: CASE-2026-WINDOWS-MCP · revision 99

Legacy date (semantics unspecified): 2026-05-14. This value is not treated as an occurrence or disclosure date.