Telnyx MCP Server Unauthenticated Access with Credential Forwarding
First seen Aug 29, 2026 · Updated Aug 29, 2026 · CVSS 9.1
The Telnyx MCP server listened on all network interfaces without enforcing caller authentication, allowing any network-reachable client to invoke tools without credentials. Because the server forwarded its own stored Telnyx API key, client secret, and code-execution key to upstream services on every dispatch, an unauthenticated attacker could execute privileged actions and code as if they were a legitimate caller. This is a critical, unauthenticated remote compromise of an AI tool-serving component.
Technical Analysis
The vulnerability resides in packages/mcp-server/src/http.ts, where the HTTP transport bound to 0.0.0.0 (all interfaces) rather than loopback, and the authentication header parser did not reject requests lacking credentials, allowing MCP session initialization and tool dispatch to proceed. Once dispatched, the server injected its own stored secrets (Telnyx API key, client secret, code-execution key) into the outbound request to the upstream Telnyx API, effectively granting the anonymous caller the server's full privileges. The entry point is any network path reaching the exposed port; no prior authentication, session token, or agent identity was required. The attacker gains the ability to invoke arbitrary MCP tools bound to the server's credentials, including code execution capability, crossing the boundary between an untrusted network caller and a privileged backend identity. This is a classic confused-deputy pattern in agent tooling: the MCP server acts as a deputy holding high-value secrets, and failure to authenticate callers lets any party exploit that trust relationship remotely.
Affected Systems
Telnyx MCP server (packages/mcp-server); protocols: MCP
Detection Signatures
- MCP server process listening on 0.0.0.0 or non-loopback interface with no auth middleware
- Inbound MCP initialize/tool-dispatch requests missing Authorization or API-key headers that still return 200/success
- Outbound requests to Telnyx API containing server-held API key/client secret triggered by unauthenticated inbound sessions
- Absence of 401/403 responses for MCP requests lacking credentials in server access logs
- Unexpected tool invocations including code-execution tool calls from unrecognized/external source IPs
Remediation Steps
- 1
Upgrade to patched version
Update the Telnyx MCP server package to the version that defaults the host to loopback and enforces the server API key in middleware.
- 2
Bind to loopback or restrict network exposure
Configure the MCP HTTP transport to listen only on 127.0.0.1 or behind a firewall/VPN, never on all interfaces, unless a reverse proxy enforces authentication.
- 3
Enforce mandatory authentication
Ensure middleware rejects any MCP initialize or dispatch request lacking a valid server API key or caller credential, failing closed rather than open.
- 4
Rotate exposed secrets
Rotate the Telnyx API key, client secret, and code-execution key for any deployment that was reachable prior to patching, since they may have been exfiltrated or misused.
- 5
Audit access logs
Review historical logs for unauthenticated MCP sessions and tool dispatches to determine if the flaw was exploited before remediation.
- 6
Adopt least-privilege credential scoping
Avoid storing high-privilege API keys directly in the MCP server process; use short-lived, scoped tokens per session where possible to limit blast radius of similar bypasses.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.