@sylphx/pdf-reader-mcp HTTP transport accepts unauthenticated requests

@sylphx/pdf-reader-mcp failed to validate the X-API-Key header on HTTP requests despite reading the MCP_API_KEY environment variable, allowing unauthenticated access to PDF tools and enabling potential file disclosure and limited SSRF attacks.

Disclosed 29 October 2026 · Record updated 29 October 2026

Impact

Unauthenticated access to PDF tools and file disclosure on affected HTTP server deployments; limited SSRF possible with URL-based sources.

Our coverage

A guard stands at a gate holding an unread badge while strangers walk freely through the open doorway into a glowing chamber.

Vulnerabilities

PDF reader MCP server ignored its own API key setting

An advisory published on 29 October 2026 says @sylphx/pdf-reader-mcp read the MCP_API_KEY variable but never checked it, leaving its HTTP endpoint open.

29 Oct 2026

Sources

github.comhttps://github.com/advisories/GHSA-q344-5v34-gm84