pdf-reader-mcp

Oct 29, 2026 4 min read

pdf-reader-mcp Said API Key Auth Was On but Never Checked It (CVE-2026-62264)

GitHub's October 29 advisory for @sylphx/pdf-reader-mcp says the HTTP transport read MCP_API_KEY, logged that authentication was enabled, and never validated the header. The fix shipped in 3.0.1 on June 25.