Listen to this Post
The self-hosted HTTP transport of @arikusi/deepseek-mcp-server exposes the POST /mcp endpoint without any authentication mechanism. The createMcpExpressApp function is invoked without an authProvider parameter, and no middleware is implemented to guard the route. This allows any client with network access to the server to issue an unauthenticated initialize request and receive a valid MCP session identifier. In reproduced testing against commit 5e1302171e99, an unauthenticated client successfully initialized a session, enumerated available tools, and invoked the local deepseek_sessions tool without supplying any credentials. The same unauthenticated session also exposes the deepseek_chat tool, which routes requests through the server-side DeepSeek client using the configured DEEPSEEK_API_KEY in self-hosted deployments.
This issue is specific to self-hosted HTTP mode and does not affect the separately documented hosted BYOK endpoint in README.md, which requires an Authorization: Bearer header. The upstream self-hosted container assets enable HTTP mode by default via the Dockerfile and publish port 3000 as defined in docker-compose.yml. The vulnerability arises because the code in src/transport-http.ts at line 17 calls createMcpExpressApp without specifying an authProvider, and the POST /mcp handler at line 31 instantiates a full MCP session for any request body that satisfies isInitializeRequest without performing any preceding authentication checks.
The attack flow is straightforward: an HTTP client sends a POST request to /mcp with a valid initialize payload, and the server responds with a 200 OK status and a newly generated mcp-session-id in the response headers. This session ID can then be used in subsequent requests to the same endpoint to call tools/list and tools/call methods. During testing, the tools/list method returned the full tool surface including deepseek_chat and deepseek_sessions, confirming that tool discovery is reachable without authentication. Furthermore, the tools/call method successfully executed the deepseek_sessions tool with the “list” action, returning the current session state.
The impact is significant for self-hosted HTTP deployments. Any host with network access to the exposed port 3000 can establish an authenticated-equivalent MCP session and invoke built-in MCP tools without supplying credentials. The deepseek_chat tool is also exposed through the same unauthenticated session, and its handler uses the server-side DeepSeek client, which means that deployments with a valid DEEPSEEK_API_KEY place billable DeepSeek operations behind an unauthenticated endpoint, potentially leading to unauthorized usage and financial costs. The remediation requires implementing authentication before MCP session creation, either by passing an authProvider to createMcpExpressApp or by placing authentication middleware or a reverse proxy in front of the /mcp route. Additionally, binding the server to 127.0.0.1 instead of 0.0.0.0 can serve as a defence-in-depth measure to reduce inadvertent exposure.
DailyCVE Form:
Platform: @arikusi/deepseek-mcp-server
Version: commit 5e1302171e99
Vulnerability: Authentication Bypass
Severity: Critical
date: 2026-08-25
Prediction: 2026-09-15
What Undercode Say:
Analytics:
- The vulnerability affects self-hosted HTTP deployments where the server is exposed to the network.
- Unauthenticated session creation and tool invocation were confirmed in testing.
- The attack vector is trivial to exploit with a simple HTTP request.
Bash commands and codes:
PoC: Unauthenticated initialize request
curl -X POST http://127.0.0.1:3000/mcp \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"poc-client","version":"1.0"}}}'
PoC: Unauthenticated tools/list request using obtained session ID
curl -X POST http://127.0.0.1:3000/mcp \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-H "mcp-session-id: <SESSION_ID_FROM_INITIALIZE>" \
-d '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}'
PoC: Unauthenticated tools/call request using obtained session ID
curl -X POST http://127.0.0.1:3000/mcp \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-H "mcp-session-id: <SESSION_ID_FROM_INITIALIZE>" \
-d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"deepseek_sessions","arguments":{"action":"list"}}}'
Check for affected code pattern in transport-http.ts
grep -n "createMcpExpressApp" src/transport-http.ts
grep -n "app.post('/mcp'" src/transport-http.ts
Check Dockerfile and docker-compose.yml for default HTTP mode
cat Dockerfile | grep TRANSPORT
cat docker-compose.yml | grep -A 5 "deepseek-mcp"
Exploit: (Educational Purposes!)
- Step 1: Send an unauthenticated initialize request to obtain a session ID.
- Step 2: Use the obtained session ID to send an unauthenticated tools/list request to enumerate available tools.
- Step 3: Use the obtained session ID to send an unauthenticated tools/call request to invoke the deepseek_sessions tool or deepseek_chat tool.
- The attacker can repeatedly send requests to consume resources or invoke the deepseek_chat tool to make unauthorized API calls using the server’s DEEPSEEK_API_KEY.
Protection:
- Pass an authProvider to createMcpExpressApp in transport-http.ts:17.
- Implement authentication middleware or a reverse proxy to guard the /mcp route.
- Bind the server to 127.0.0.1 instead of 0.0.0.0 in createMcpExpressApp and app.listen.
- Update docker-compose.yml to publish the port as 127.0.0.1:3000:3000 to limit exposure.
- Ensure that the hosted BYOK endpoint (which requires Authorization header) is used instead of self-hosted HTTP mode in production.
Impact:
- Unauthenticated remote attackers can establish MCP sessions and invoke tools.
- The deepseek_chat tool can be used to make unauthorized billable requests using the server-side API key.
- The vulnerability could lead to resource exhaustion, financial costs, and potential data exposure if chat history or session data is accessible.
- The issue affects all self-hosted HTTP deployments that use the default configuration without additional authentication controls.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
