CVE-2026-81098: Missing Authentication for Critical Function in team-telnyx telnyx-mcp

The Telnyx MCP server previously exposed its HTTP transport on every interface and did not enforce caller authentication. The server parsed authentication headers in a way that did not fail when absent, allowing unauthenticated requests to complete initialization and dispatch tools. These dispatched requests forwarded the server's stored credentials, including the Telnyx API key, client secret, and code-execution key, to upstream endpoints. This meant an unauthenticated caller with network access to the port could act with these credentials. The vulnerability affects versions <=6.83.0. The current code defaults the host to loopback, requires a server API key, and enforces authentication via middleware.

An unauthenticated attacker able to reach the exposed HTTP port could perform actions with the server's stored credentials, including the Telnyx API key and client secret, potentially leading to unauthorized access and code execution on upstream endpoints. The CVSS 4.0 score is 9.3 (critical), indicating a high impact with network attack vector, no privileges or user interaction required, and high impact on confidentiality and integrity.

No official patch or remediation level is explicitly stated in the provided data. However, the current code changes default the host to loopback and enforce API key authentication via middleware, mitigating the vulnerability. Users should upgrade to versions later than 6.83.0 where these mitigations are implemented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.