{"vulnerability": "CVE-2026-55605", "sightings": [{"uuid": "af3e1f91-72e0-4d5d-a7fc-429d8bc6fd5c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55605", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcrtzifdi2d", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-55605 \u0432 DeepSeek MCP Server: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/9D6C46B7-0C4E-498E-AAC8-C1FB0F8FA577", "creation_timestamp": "2026-07-10T18:31:48.592570Z"}, {"uuid": "f2a21e2b-55f8-453a-8752-0a5ffa3efe9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55605", "type": "seen", "source": "https://gist.github.com/alon710/d086a00580da0e8964a59634ddcd20cd", "content": "# CVE-2026-55605: CVE-2026-55605: Missing Authentication in @arikusi/deepseek-mcp-server HTTP Transport Endpoint\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-08-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55605\n\n## Summary\nThe self-hosted HTTP transport mode of @arikusi/deepseek-mcp-server (an MCP server for DeepSeek V4) exposes its JSON-RPC endpoint (POST /mcp) without authentication in versions 1.4.2 through 1.7.0. Unauthenticated clients can establish Model Context Protocol sessions and invoke tools, consuming the host's configured DeepSeek API key.\n\n## TL;DR\nUnauthenticated remote attackers can query DeepSeek models and deplete system quotas via an exposed JSON-RPC endpoint on port 3000.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-306\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1**: 5.3 (Medium)\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n- **Affected Component**: HTTP Transport Mode (transport-http.ts)\n\n## Affected Systems\n\n- @arikusi/deepseek-mcp-server\n- **@arikusi/deepseek-mcp-server**: >= 1.4.2, < 1.8.0 (Fixed in: `1.8.0`)\n\n## Mitigation\n\n- Upgrade to version 1.8.0 or higher\n- Configure HTTP_AUTH_TOKEN environment variable\n- Restrict service binding to localhost (127.0.0.1)\n\n**Remediation Steps:**\n1. Update NPM dependencies to retrieve the patched package version.\n2. Set the HTTP_AUTH_TOKEN environment variable to a strong, generated secret.\n3. Modify Docker Compose or host binding configurations to prevent exposure to untrusted networks.\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55605) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-25T19:32:23.850349Z"}, {"uuid": "a66721a2-878c-4290-aad7-5f0af9c94413", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-55605", "type": "published-proof-of-concept", "source": "https://github.com/arikusi/deepseek-mcp-server/security/advisories/GHSA-72f3-6w86-7rv3", "content": "", "creation_timestamp": "2026-08-25T20:35:10.446016Z"}]}