Nacho Sanchez Gines Gearboy authorization issue vulnerability

Versions of Nacho Sanchez Gines Gearboy prior to 3.8.7 contain an authorization issue vulnerability. This vulnerability arises because its MCP HTTP mode accepts unauthenticated MCP requests; the socket is bound to INADDRANY without checking Authorization, Host, and Origin parameters. As a result,...

Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise

How default keys, unauthenticated MCP sessions, and custom code guardrails expose cloud AI infrastructure to root-level remote code execution and IAM theft...

PT-2026-33891

Summary Several HTTP transport endpoints in n8n-mcp lacked proper authentication, and the health check endpoint exposed sensitive operational metadata without credentials. Impact An unauthenticated attacker with network access to the n8n-mcp HTTP server could disrupt active MCP sessions and gathe...