MCP Connect has unauthenticated remote OS command execution via /bridge endpoint
Date: 2026-03
Affected: npm/mcp-bridge
Attack vector: command-injection
Category: vulnerability-disclosure
Severity: Critical
CWE: CWE-306
CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

### Summary When _AUTH_TOKEN_ and _ACCESS_TOKEN_ environment variables are not set (which is the default out-of-the-box configuration) the _/bridge_ HTTP endpoint is completely unauthenticated. Any network-accessible caller can POST a request with an attacker-controlled serverPath and args payload, causing the server to spawn an arbitrary OS process as the user running mcp-bridge. This results in full remote code execution on the host without any credentials. ### Details **Root cause 1 - Authentication not enforced when token is absent** _src/config/config.ts_ line 161 sets authToken to an empty string when neither environment variable is configured: ``` authToken: process.env.AUTH_TOKEN || process.env.ACCESS_TOKEN || '', ``` The auth middleware in _src/server/http-server.ts_ lines 118–141 wraps all enforcement in if (_this.accessToken_). Because an empty string is falsy in JavaScript, the entire block is skipped and next() is called unconditionally for every request: ``` if (this.accessToken) { // ... token validation - never reached when token is ''} next(); // always reached in default config ``` The only consequence of a missing token is a log warning (line 42–43). The server starts and serves requests normally. **Root cause 2 - _/bridge_ spawns arbitrary processes from request body input** _src/server/http-server.ts_ lines 194 and 218/227 extract _serverPath_ and _args_ directly from the untrusted JSON body and pass them to _MCPClientManager.createClient()_ without a


Mitigations:

Architectural layers (MAESTRO):