AIKIDO-2026-243497

@circleci/mcp-server-circleci is vulnerable to Improper Authentication

Improper AuthenticationGHSA-xv5j-cwgj-22r4 Published Aug 11, 2026

Critical Risk

This Affects:

@circleci/mcp-server-circleci

0.16.1 - 0.19.1

Fixed in 0.19.2

Are you affected? Scan for Free

TL;DR

The remote Streamable HTTP/SSE transport supports a shared-token mode where the organization's CircleCI token lives on the server and callers present no credential, which is only safe when the port is restricted to a trusted network. The transport defaults to binding all interfaces, and the only network-facing control on /mcp is a Host/Origin check that a non-browser client fully controls by sending an allowed Host and omitting Origin. An unauthenticated network-adjacent caller can reach /mcp, pass the check, and invoke tools such as run_pipeline using the server's token, yielding code execution in the organization's CI with access to its secrets and OIDC identity. The fix refuses to start the transport when request authentication is disabled and the bind address is non-loopback, unless the operator explicitly acknowledges unauthenticated network access.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you run the remote transport in shared-token mode bound to a non-loopback interface. You are not affected when running in the default per-request-token mode or when the port is bound to loopback only.