CVE-2026-100868
Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without…
- Risk score
- 41/100
- CVSS
- 6.3 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 27 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return forged results to the MC…
- Affected
- See advisory
- Fix
- Upgrade the product to 2.18.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.3 medium
References
- https://github.com/penpot/penpot
- https://github.com/penpot/penpot/blob/1d2c37e52c733f74017d90b0fd1ae2d074a5c33d/mcp/packages/server/src/PluginBridge.ts#L52
- https://github.com/penpot/penpot/commit/b5274a44766d095247037be18c1d1918ac67ddeb
- https://github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm
- https://github.com/penpot/penpot/security/advisories/GHSA-ch2q-6x56-qg5r
- https://www.vulncheck.com/advisories/penpot-before-2.18.0-unauthenticated-websocket-access-via-mcp-bridge
- https://github.com/penpot/penpot/security/advisories/GHSA-ch2q-6x56-qg5r
Original description
Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return forged results to the MCP client.
Last activity 27 Sep 2026. Patch Forecast updates every hour.