External risk intelligence

MCP Router CLI Default Open Aggregator Exposure

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-81094

The application is a CLI tool designed to serve an aggregator and associated services. By default, it exposed the service on all network interfaces without authentication. While primarily a developer or operational tool, its function as an aggregator and its default configuration to bind to all interfaces make it prone to inadvertent exposure in network-connected deployment environments.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in the mcp-router command-line interface that could allow unauthorized access to its aggregator service. By default, the service was exposed on all network interfaces without requiring authentication, making it accessible to anyone who could reach the specific port. This oversight means that any MCP server fronted by this router could potentially be exposed.

Unauthenticated access to a network service.
Default configuration exposed sensitive functions.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could reach the vulnerable MCP aggregator by sending network requests to a port that the mcp-router CLI is listening on. If the CLI was invoked without specifying an authentication token, the aggregator would be exposed on all network interfaces, allowing unauthenticated access. This could allow an attacker to interact with any MCP server that the aggregator fronts.

Network access to the port.
Default invocation of the CLI.
Unauthenticated access to MCP servers.

Live Threat

Current exploitation, exposure, and threat context

When an MCP aggregator is served without requiring authentication, it can expose the aggregator and any MCP servers it fronts to unauthorized access. This could occur when the CLI tool's default invocation is used, binding the aggregator to all network interfaces on a fixed port without requiring a token.

MCP aggregator and associated servers.
Default invocation without authentication token.
Unauthorized access to aggregated data.

Operational Fix

Recommended remediation, mitigation, and detection steps

The mcp-router CLI's default configuration to serve its MCP aggregator on all interfaces without requiring authentication presents a critical risk, potentially exposing all fronted MCP servers to any attacker capable of reaching the exposed port. Ownership likely resides with teams managing the application's deployment and security, such as platform or application owners, with initial steps focusing on asset discovery and risk assessment.

Application owners should manage the issue.
Verify reachability and business criticality.
Plan remediation based on discovered risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the mcp-router CLI?

The mcp-router CLI is a command-line tool used to run an MCP (Model Context Protocol) aggregator. It acts as a central hub that connects and manages multiple MCP servers, allowing them to communicate and share data through a unified interface. Developers and teams use this component to bridge services and streamline interactions between different AI-driven resources.

What does CVE-2026-81094 mean for security?

This vulnerability is classified as CWE-306, which refers to a Missing Authentication for Critical Function. In simple terms, the software failed to require a digital key to access the aggregator service by default. Because authentication was optional rather than mandatory, anyone capable of reaching the service's network port could interact with it as if they were an authorized user.

How is this vulnerability triggered?

The flaw occurs when the CLI is started using its default settings, which binds the service to all available network interfaces on a fixed port without demanding an authentication token. Crucially, the issue does not trigger if the service is configured to bind only to the local loopback address, as this prevents external network traffic from reaching the aggregator.

Do I need to worry about this if my service is internal?

Yes. Halo Surface Signal identifies this as a potential risk because, by default, the tool exposes the aggregator across all network interfaces, not just local ones. Even if a service is not intentionally internet-facing, it may still be reachable by unauthorized parties within your internal network who can connect to the port.

Is there a practical way to fix this?

The primary step is to upgrade to release 0.6.3 or later, which changes the default behavior to bind only to the local loopback address and enforces mandatory authentication for non-loopback connections. Until you can update, ensure you are manually supplying an authentication token and restricting network access to the service port.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.