CVE-2026-108856: UnicomAI Wanwu through 0.6.5 Authorization Bypass via /v1/appspace/app/key AppKey Minting
UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that allows authenticated users to mint AppKeys bound to other users' MCP servers via POST /v1/appspace/app/key. Attackers supplying a victim's MCP server UUID with appType mcpserver can open MCP sessions and invoke the server's tools using the victim's upstream authentication.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with low privileges can exploit it. The attacker must be able to submit a POST request to /v1/appspace/app/key and provide the UUID of another user's MCP server with appType set to mcpserver.
What access does a minted AppKey provide?
The attacker can use the AppKey to open MCP sessions to the victim's MCP server and invoke that server's tools. Those actions use the victim's upstream authentication, which can expose or alter resources available through the victim's MCP integration.
Which versions are known to be affected?
UnicomAI Wanwu through version 0.6.5 is affected. The provided information does not identify a fixed version.
How can I determine whether my deployment may be exposed?
A deployment may be exposed if authenticated users can reach POST /v1/appspace/app/key and can supply an MCP server UUID and appType mcpserver. Review AppKey creation activity for keys associated with MCP server UUIDs owned by different users, and investigate subsequent MCP sessions or tool invocations using those keys.