4 min read
News Brief GitHub's October 29 advisory for @sylphx/pdf-reader-mcp says the HTTP transport read MCP_API_KEY, logged that authentication was enabled, and never validated the header. The fix shipped in 3.0.1 on June 25.
authentication bypass
5 min read
Vulnerabilities A new critical authentication bypass in LiteLLM lets attackers manipulate the HTTP Host header to access protected management endpoints without credentials. Fixed in version 1.84.0, disclosed June 17.
3 min read
Vulnerabilities CISA added CVE-2026-42271 to KEV after Horizon3.ai chained the LiteLLM MCP command injection flaw with a Starlette auth bypass for unauthenticated RCE. Federal deadline: June 22.