CVE-2026-100868mediumCWE-1327

Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridge

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.3%

exploitation probability

0.3%top 84% of all CVEs

observed exploitation

nono source reports it

Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return forged results to the MCP client.

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Affected products

penpot · penpot penpot · @penpot/mcp

References

https://github.com/penpot/penpot https://github.com/penpot/penpot/blob/1d2c37e52c733f74017d90b0fd1ae2d074a5c33d/mcp/packages/server/src/PluginBridge.ts#L52 https://github.com/penpot/penpot/commit/b5274a44766d095247037be18c1d1918ac67ddeb https://github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm https://github.com/penpot/penpot/security/advisories/GHSA-ch2q-6x56-qg5r https://www.vulncheck.com/advisories/penpot-before-2.18.0-unauthenticated-websocket-access-via-mcp-bridge