THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-72f3-6w86-7rv3 (medium) — @arikusi/deepseek-mcp-server: Missing Authentication on Self-Hosted HTTP MCP Endpoint

[GHSA] GHSA-72f3-6w86-7rv3 (medium) — @arikusi/deepseek-mcp-server: Missing Authentication on Self-Hosted HTTP MCP Endpoint

medgithub_advisoriesPublished 2026-08-25

GHSA-72f3-6w86-7rv3 Severity: medium CVE: CVE-2026-55605

@arikusi/deepseek-mcp-server: Missing Authentication on Self-Hosted HTTP MCP Endpoint

## Summary The self-hosted HTTP transport of `@arikusi/deepseek-mcp-server` exposes `POST /mcp` without any authentication: `createMcpExpressApp` is called without an `authProvider` and no middleware guards the route, so any network-reachable client can i

MITRE ATT&CK techniques

CredentialsT1589.001

Indicators of compromise

CVE-2026-55605cve

Original source: https://github.com/advisories/GHSA-72f3-6w86-7rv3