Five new MCP server CVEs, and four of them are the same bug: a network listener with no authentication

NVD·high signalXBlueskyLinkedInCopy link

NVD's 09-16 to 09-18 window added CVE-2026-54618 (Obsidian Web MCP before 0.2.0 issues an OAuth authorization code with no login or consent check, then exchanges it for the static VAULT_MCP_TOKEN, exposing vault_read/vault_write), CVE-2026-54504 (MCP Documentation Server 1.13.0 auto-starts a Web UI calling app.listen(3080) with no host, binding the unauthenticated document API to every interface), CVE-2026-54446 (NetLicensing MCP before 0.1.6 lets /mcp requests omitting the API key pass straight through ApiKeyMiddleware) and CVE-2026-50125 (MKP before 0.4.1 registers an unauthenticated get_resource tool taking unbounded limitBytes/tailLines on pod logs). The fifth, CVE-2026-50158, is a path-confinement escape in yutu before 0.10.9 where the caption-download tool os.Create()s a caller-supplied path outside the YUTU_ROOT boundary. If you run any MCP server over HTTP, the default host binding is now the single highest-yield thing to audit.