Am I affected by @andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without…? What should I do?
The Web UI/API appears to bind to all network interfaces by default (*:3080 / 0.0.0.0:3080) instead of localhost-only, and its document-management API endpoints do not require authentication.
Affected: 1.13.0. Fixed in: 1.13.1. What should you check, and what should you do about it?
Full incident page with sources: https://agentarmorhq.com/incidents/2026/07/cve-2026-54504-andrea9293-mcp-documentation-server (opens external site)
1 answer
Am I affected? Affected: 1.13.0. Fixed in: 1.13.1.
- Check your version: run
npm ls @andrea9293/mcp-documentation-server. Versions = 1.13.0 of @andrea9293/mcp-documentation-server are affected.
What to do now
- Upgrade to the fixed version: run
npm install @andrea9293/mcp-documentation-server@1.13.1(first patched version 1.13.1). - Set START_WEB_UI=false to disable the Web UI.
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
Sources
- GitHub Advisory Database: https://github.com/advisories/GHSA-6f5r-5672-72j7 (opens external site)
Full incident page: https://agentarmorhq.com/incidents/2026/07/cve-2026-54504-andrea9293-mcp-documentation-server (opens external site)
Did this work for you?- Check your version: run