CVE-2026-81098
CriticalCVSS 9.1Summary
The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller credential. Requests without credentials could initialize and dispatch tools, forwarding the server's stored credentials (Telnyx API key, client secret, code-execution key) to the upstream endpoint. The current code defaults to loopback, requires a server API key, and enforces it in middleware.
Risk Assessment
An unauthenticated attacker can use server credentials to perform operations on the Telnyx account, leading to unauthorized access and potential damage.
Recommendation
Update the Telnyx MCP server to a version with loopback default and required authentication, and configure a server API key.
Original NVD description (English source)
The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller credential. packages/mcp-server/src/http.ts served MCP on the root path with a listener bound to all interfaces and parsed the caller's authentication headers in a mode that did not fail when they were absent, so a request without any credential completed initialisation and dispatched tools. Dispatch forwarded the server's own stored credentials, the Telnyx API key and client secret together with the code-execution key, to the upstream endpoint, so an unauthenticated caller able to reach the port acted with them. The current code defaults the host to loopback, requires a server API key, and enforces it in middleware.