{"uuid": "f2a21e2b-55f8-453a-8752-0a5ffa3efe9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55605", "type": "seen", "source": "https://gist.github.com/alon710/d086a00580da0e8964a59634ddcd20cd", "content": "# CVE-2026-55605: CVE-2026-55605: Missing Authentication in @arikusi/deepseek-mcp-server HTTP Transport Endpoint\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-08-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55605\n\n## Summary\nThe self-hosted HTTP transport mode of @arikusi/deepseek-mcp-server (an MCP server for DeepSeek V4) exposes its JSON-RPC endpoint (POST /mcp) without authentication in versions 1.4.2 through 1.7.0. Unauthenticated clients can establish Model Context Protocol sessions and invoke tools, consuming the host's configured DeepSeek API key.\n\n## TL;DR\nUnauthenticated remote attackers can query DeepSeek models and deplete system quotas via an exposed JSON-RPC endpoint on port 3000.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-306\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1**: 5.3 (Medium)\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n- **Affected Component**: HTTP Transport Mode (transport-http.ts)\n\n## Affected Systems\n\n- @arikusi/deepseek-mcp-server\n- **@arikusi/deepseek-mcp-server**: >= 1.4.2, < 1.8.0 (Fixed in: `1.8.0`)\n\n## Mitigation\n\n- Upgrade to version 1.8.0 or higher\n- Configure HTTP_AUTH_TOKEN environment variable\n- Restrict service binding to localhost (127.0.0.1)\n\n**Remediation Steps:**\n1. Update NPM dependencies to retrieve the patched package version.\n2. Set the HTTP_AUTH_TOKEN environment variable to a strong, generated secret.\n3. Modify Docker Compose or host binding configurations to prevent exposure to untrusted networks.\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55605) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-25T19:32:23.850349Z"}