What’s Vulnerable › Vulnerabilities

CVE-2026-58446: Presenton < 0.8.8-beta - Authentication Bypass of Session Auth via Unprotected MCP Endpoint

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-30 · updated 2026-07-14
• Weakness: CWE-306

Description

Presenton before 0.8.8-beta bundles an MCP server that, on server/Docker deployments configured with session authentication (AUTH_USERNAME/AUTH_PASSWORD), is reachable unauthenticated at /mcp because the nginx front-end does not apply the auth_request gate to that path and the MCP server auto-mints a valid internal session token for the configured user. A remote unauthenticated attacker can invoke MCP tools such as generate_presentation, performing authenticated application actions, consuming the operators configured LLM API keys, and creating presentations in the operators instance. The Electron desktop build is not affected (MCP disabled).

Affected products

• presenton: before 0.8.8-beta — fixed in 0.8.8-beta

How to fix

Upgrade to a fixed version: presenton 0.8.8-beta. Check the vendor advisory for mitigations.

References

• https://github.com/presenton/presenton/commit/a1103dcef3c761cc8bab44e2862c81a49969abd7
• https://github.com/presenton/presenton/issues/678
• https://github.com/presenton/presenton/pull/679
• https://github.com/presenton/presenton/releases/tag/electron-v0.8.8-beta
• https://www.vulncheck.com/advisories/presenton-beta-authentication-bypass-of-session-auth-via-unprotected-mcp-endpoint
• https://github.com/presenton/presenton/issues/678

Get alerted when CVE-2026-58446 or the next vulnerability affects your stack