Threats affecting pkg:github/sylphxai/pdf-reader-mcp

CVE-2026-62264 is a vulnerability in SylphxAI's pdf-reader-mcp affecting versions 2.2.0 through before 3.0.1. When the HTTP server is enabled via MCP_TRANSPORT=http, the server logs that API key authentication is enabled but does not actually validate the X-API-Key header. This allows unauthenticated clients to access the /mcp endpoint and use PDF reading tools with the permissions of the server process. The default bind address 0.0.0.0 exposes this to any reachable client. URL-based sources can also trigger limited server-side request forgery if private IP allowance is enabled. The issue is fixed in version 3.0.1.