{"id":26087,"date":"2026-09-18T04:32:20","date_gmt":"2026-09-17T20:32:20","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-54504"},"modified":"2026-09-18T04:32:20","modified_gmt":"2026-09-17T20:32:20","slug":"cve-2026-54504","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-54504","title":{"rendered":"CVE-2026-54504 [HIGH] &#8211; MCP Documentation Server is a local-first document management and semantic search server f"},"content":{"rendered":"<p>MCP Documentation Server is a local-first document management and semantic search server for AI coding agents. From 1.13.0 until 1.13.1, the automatically started Web UI in src\/server.ts calls startWebServer in src\/web-server.ts with START_WEB_UI enabled by default and WEB_PORT set to 3080. startWebServer uses app.listen(PORT) without a host, which binds the unauthenticated document-management API to all interfaces rather than localhost. A network-reachable client can invoke GET \/api\/documents, GET \/api\/documents\/:id, POST \/api\/documents, POST \/api\/search-all, DELETE \/api\/documents\/:id, and GET \/api\/config without credentials to enumerate and read documents, search the corpus, insert or delete documents, and tamper with the MCP assistant&#8217;s knowledge base. The service must be reachable from the attacker&#8217;s LAN, VM network, container bridge, VPN, or another routed network, and the issue does not provide remote code execution. This issue is fixed in 1.13.1.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>MCP Documentation Server is a local-first document management and semantic search server for AI coding agents. From 1.13.0 until 1.13.1, the automatically started Web UI in src\/server.ts calls startWe<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-26087","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/26087","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=26087"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=26087"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=26087"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}