CVE-2026-81098: Telnyx MCP Server through 6.83.0 Missing Authentication on Streamable HTTP Transport
The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller credential. packages/mcp-server/src/http.ts served MCP on the root path with a listener bound to all interfaces and parsed the caller's authentication headers in a mode that did not fail when they were absent, so a request without any credential completed initialisation and dispatched tools. Dispatch forwarded the server's own stored credentials, the Telnyx API key and client secret together with the code-execution key, to the upstream endpoint, so an unauthenticated caller able to reach the port acted with them. The current code defaults the host to loopback, requires a server API key, and enforces it in middleware.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated remote use?
Deployments through 6.83.0 are exposed if an attacker can reach the MCP server's HTTP port. The affected transport listened on every interface, served MCP on the root path, and accepted requests with no caller credential.
What access does a successful unauthenticated caller receive?
The caller can dispatch MCP tools using the server's stored Telnyx API key, client secret, and code-execution key. This lets the caller act against the upstream endpoint with those server-held credentials.
Are newer default settings affected?
The current code defaults the host to loopback, requires a server API key, and enforces that key in middleware. These changes address both external exposure and missing caller authentication.