Evidence · DiggingBeagle record
GitHub security advisory GHSA-q344-5v34-gm84 for PDF Reader MCP
Reviewed advisory describing an HTTP mode that advertises MCP_API_KEY authentication without enforcing X-API-Key on requests.
- Source role
- primary disclosure
Evidence record
Reviewed advisory describing an HTTP mode that advertises MCP_API_KEY authentication without enforcing X-API-Key on requests.
Claim-level citations (1)
- supportsPDF Reader MCP exposed document tools despite a configured API key: GitHub advisory GHSA-q344-5v34-gm84 says @sylphx/pdf-reader-mcp versions 2.2.0 before 3.0.1 accepted unauthenticated HTTP /mcp requests even when MCP_API_KEY was set.
GHSA-q344-5v34-gm84, Affected versions, Impact and patched 3.0.1