Am I affected by Streamable HTTP mode exposes LINE Desktop read/send tools without MCP authentication? What should I do?
line-desktop-mcpsupports a--http-modeStreamable HTTP transport for use with clients such as n8n.Affected: line-desktop-mcp <= 1.1.1. Fixed in: 1.1.2. What should you check, and what should you do about it?
Full incident page with sources: https://agentarmorhq.com/incidents/2026/06/cve-2026-49357-line-desktop-mcp (opens external site)
1 answer
Am I affected? Affected: line-desktop-mcp <= 1.1.1. Fixed in: 1.1.2.
- Check your version: run
npm ls line-desktop-mcp. Versions <= 1.1.1 of line-desktop-mcp are affected.
What to do now
- Upgrade to the fixed version: run
npm install line-desktop-mcp@1.1.2(first patched version 1.1.2). - Require a bearer token or local secret when
--http-modeis used. - Bind HTTP mode to
127.0.0.1by default unless the operator explicitly opts into network exposure.
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
Sources
- GitHub Advisory Database: https://github.com/advisories/GHSA-4hf8-5mjm-rfgq (opens external site)
Full incident page: https://agentarmorhq.com/incidents/2026/06/cve-2026-49357-line-desktop-mcp (opens external site)
Did this work for you?- Check your version: run