mcp-router Insecure-by-Default Network Exposure and Missing Authentication

Technical Analysis

The vulnerability lies in apps/cli/src/commands/serve.ts, where the default host value was set to 0.0.0.0 (all interfaces) on a fixed port, and the authentication token was only enforced when a CLI flag was explicitly passed. Because mcp-router acts as an aggregator that fronts multiple downstream MCP servers, any unauthenticated network-reachable client could enumerate and invoke every tool exposed through the aggregator, effectively bypassing per-server access controls. The entry point is the network socket itself rather than a prompt or model-level attack surface, but the consequence is full tool-layer compromise: an attacker gains the same capabilities as a legitimate MCP client, including invocation of any aggregated tool, potential data exfiltration, and use of those tools as a pivot into backend systems. This crosses trust boundaries because it converts a local development convenience (unauthenticated default) into an internet- or LAN-facing unauthenticated API surface for all connected agent tools.

Affected Systems

mcp-router; protocols: MCP

Detection Signatures

• mcp-router serve process listening on 0.0.0.0 or non-loopback interface without --token flag
• Inbound connections to mcp-router aggregator port from unexpected external or internal IP ranges
• Absence of authentication headers/tokens in MCP requests reaching the aggregator
• Network scan/traffic logs showing unauthenticated JSON-RPC/MCP handshake requests to the aggregator port

Remediation Steps

1. 1

   Upgrade to mcp-router 0.6.3+

   Update to the patched release which defaults to loopback binding and enforces token authentication whenever a non-loopback host is configured.

2. 2

   Explicitly bind to loopback or trusted interfaces

   Configure the serve command to bind only to 127.0.0.1 or internal-only interfaces unless remote access is intentionally required.

3. 3

   Always require authentication tokens

   Set the authentication token flag explicitly on every deployment regardless of host binding, and avoid relying on default behavior.

4. 4

   Network-level restriction

   Use firewall rules or security groups to restrict access to the mcp-router port to known, trusted hosts only.

5. 5

   Audit existing deployments

   Review all running mcp-router instances for exposed ports and missing authentication, and rotate any credentials that may have been reachable through the aggregator.