Tracking: CVE-2026-55605
Severity: Medium
Who is affected
@arikusi/deepseek-mcp-server from 1.4.2 to before 1.8.0 in self-hosted HTTP mode. The advisory distinguishes this path from stdio transport and the separately hosted bring-your-own-key service.
How the attack works
The /mcp HTTP route accepts initialization and tool calls without an authProvider. A remote caller can create an MCP session and reach exposed operations. The report includes session enumeration through deepseek_sessions and model calls through deepseek_chat when the server has a configured API key.
The practical exposure includes local session information and unauthorized use of the operator's model account. A reachable HTTP listener should therefore be evaluated as an authenticated service, even when intended for internal use.
What to do
- Upgrade to 1.8.0 or later and verify authentication on initialization and subsequent tool calls.
- Restrict HTTP ingress and review session creation, session listing, chat activity, and model-account usage.
- Investigate unexpected requests before deciding which stored conversations or credentials may have been exposed.
Scope and limits
The separate cross-session authorization flaw, CVE-2026-55604, was fixed in 1.7.0. That earlier fix alone does not resolve this HTTP authentication issue.