CVE-2026-100868

Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return forged results to the MCP client.

CVSS v3 6.3 MEDIUM

6.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.4

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/penpot/penpot
https://github.com/penpot/penpot/blob/1d2c37e52c733f74017d90b0fd1ae2d074a5c33d/mcp/packages/server/src/PluginBridge.ts#L52
https://github.com/penpot/penpot/commit/b5274a44766d095247037be18c1d1918ac67ddeb
https://github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm
https://github.com/penpot/penpot/security/advisories/GHSA-ch2q-6x56-qg5r
https://www.vulncheck.com/advisories/penpot-before-2.18.0-unauthenticated-websocket-access-via-mcp-bridge
https://github.com/penpot/penpot/security/advisories/GHSA-ch2q-6x56-qg5r

Configurations

No configuration.

History

28 Sep 2026, 16:17

Type	Values Removed	Values Added
References	~~() https://github.com/penpot/penpot/security/advisories/GHSA-ch2q-6x56-qg5r -~~	() https://github.com/penpot/penpot/security/advisories/GHSA-ch2q-6x56-qg5r -

27 Sep 2026, 13:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-27 13:16

Updated : 2026-10-08 16:17

NVD link : CVE-2026-100868

Mitre link : CVE-2026-100868

CVE.ORG link : CVE-2026-100868

JSON object : View

Products Affected

No product.

CWE

CWE-1327

Binding to an Unrestricted IP Address

{"id": "CVE-2026-100868", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-100868", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-28T15:39:30.501039Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "penpot", "product": "penpot", "versions": [{"status": "affected", "version": "0", "lessThan": "2.18.0", "versionType": "semver"}], "packageURL": "pkg:npm/%40penpot/mcp", "defaultStatus": "unaffected"}, {"vendor": "penpot", "product": "@penpot/mcp", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.15.4"}], "packageURL": "pkg:npm/%40penpot/mcp", "packageName": "@penpot/mcp", "collectionURL": "https://www.npmjs.com", "defaultStatus": "unaffected"}]}], "published": "2026-09-27T13:16:37.960", "references": [{"url": "https://github.com/penpot/penpot", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/penpot/penpot/blob/1d2c37e52c733f74017d90b0fd1ae2d074a5c33d/mcp/packages/server/src/PluginBridge.ts#L52", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/penpot/penpot/commit/b5274a44766d095247037be18c1d1918ac67ddeb", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/penpot/penpot/security/advisories/GHSA-ch2q-6x56-qg5r", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/penpot-before-2.18.0-unauthenticated-websocket-access-via-mcp-bridge", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/penpot/penpot/security/advisories/GHSA-ch2q-6x56-qg5r", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-1327"}]}], "descriptions": [{"lang": "en", "value": "Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return forged results to the MCP client."}], "lastModified": "2026-10-08T16:17:00.783", "sourceIdentifier": "disclosure@vulncheck.com"}