Zero Radar
← feed
HighVulnerabilityCVE-2026-62264updated 30 Oct 2026, 19:19 UTC

PDF Reader MCP server lets anyone on the network read your PDFs

If you run this PDF tool in HTTP mode, anyone who can reach its network port can use it without a password, and read PDF files on the machine. Setting an API key did not actually protect it.

Fix availableOfficial, 2 sources
SeverityHighCVSS 7.5 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yes@sylphx/pdf-reader-mcp 3.0.1 (enforces X-API-Key with constant-time comparison, defaults to 127.0.0.1, warns when binding non-loopback without a key) · since 29 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Remote clientReaches the open port on the network
  2. 2HTTP /mcp endpointKey header is logged but never checked
  3. 3PDF tools runAny tool is callable without auth
  4. 4Local PDFs readAny file the process can open
  5. ResultAttacker reads PDFs without credentials

What happened

In @sylphx/pdf-reader-mcp versions 2.2.0 to before 3.0.1, the HTTP transport's /mcp endpoint never checks the X-API-Key header, despite logging that API key authentication is enabled. It also binds to 0.0.0.0 by default, exposing it on all network interfaces; URL sources allow limited SSRF.

Why it is dangerous: Anyone who can reach the port can invoke every PDF tool and read any PDF the server process can open, potentially exposing confidential documents. Limited server-side request forgery is also possible.

Are you affected?

You are affected if you run @sylphx/pdf-reader-mcp 2.2.0 through 3.0.0 with MCP_TRANSPORT=http, especially with the default 0.0.0.0 bind address and reachable from a network you do not fully trust. The default stdio transport is not affected.

Package / productAffected versionsFixed in
@sylphx/pdf-reader-mcp · npm>= 2.2.0, < 3.0.13.0.1

What to do

  1. Update @sylphx/pdf-reader-mcp to 3.0.1 or later
  2. If you cannot upgrade yet, bind to loopback only with MCP_HTTP_HOST=127.0.0.1
  3. Or place an authenticating reverse proxy in front, or switch to the stdio transport
  4. Restrict readable folders with --allow-dir or MCP_PDF_ALLOWED_DIRS

Timeline

  1. 29 Oct 2026, 16:34 UTC
    Publicly disclosed
  2. 29 Oct 2026, 16:34 UTC
    Reported by GitHub Advisory · GitHub Advisory
  3. 29 Oct 2026, 16:35 UTC
    Picked up by Zero Radar
  4. 30 Oct 2026, 19:19 UTC
    NVD reported on it · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-62264 · GHSA-q344-5v34-gm84
CVSS
7.5 / 10
Disclosed
29 Oct 2026, 16:34 UTC
On Zero Radar
29 Oct 2026, 16:35 UTC (1 min after disclosure)
Last change
30 Oct 2026, 19:19 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

PDF Reader MCP server lets anyone on the network read your PDFs · Zero Radar