CVE-2026-100868: Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridge
Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return forged results to the MCP client.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Penpot deployments before 2.18.0 are affected when running in single-user mode with the MCP server plugin WebSocket bridge. The bridge binds to all network interfaces, making it reachable by attackers on adjacent networks.
What does an attacker need to exploit this issue?
An attacker needs adjacent-network access to the WebSocket port. No authentication, privileges, or user interaction are required.
What can an attacker do after connecting?
An attacker can impersonate the Penpot browser plugin, intercept task payloads, and send forged results to the MCP client.
How can this be remediated?
Upgrade Penpot to version 2.18.0 or later. The issue affects versions before 2.18.0.