The deepseek-mcp-server component of arikusi, from version 1.4.2 prior to 1.8.0, exposes a critical function via the POST /mcp HTTP endpoint without any authentication. The server's createMcpExpressApp function is called without an authProvider, leaving the route unguarded. This allows any network-reachable client to issue an unauthenticated initialize request, obtain a valid MCP session identifier, enumerate tools, and invoke local tools such as deepseek_sessions and deepseek_chat. The deepseek_chat handler uses the server-side DEEPSEEK_API_KEY if configured, potentially exposing sensitive operations. This vulnerability applies only to self-hosted HTTP mode, not the hosted BYOK endpoint which requires authorization. The issue is fixed in version 1.8.0.

An unauthenticated attacker on the network can initialize sessions and invoke internal tools without credentials, potentially leading to unauthorized actions and denial of service. The vulnerability does not impact confidentiality or integrity directly but can cause availability issues (denial of service). The CVSS score is 5.3 (medium severity) reflecting network attack vector, low complexity, no privileges required, no user interaction, and impact limited to availability.

Version 1.8.0 contains a patch that adds authentication to the POST /mcp endpoint, preventing unauthenticated access. Users should upgrade to version 1.8.0 or later to remediate this vulnerability. Until then, restricting network access to the self-hosted HTTP transport port (default 3000) can reduce exposure. The hosted BYOK endpoint is not affected and requires authorization.