What happened
NetBox MCP Server before 1.2.1 exposed its HTTP transport with no authentication, letting any reachable client obtain an MCP session and full tool access (CWE-306). CVSS 5.9, published 2026-10-23.
Why it matters
MCP servers are the trusted tool surface an LLM agent calls; an unauthenticated MCP endpoint means an attacker or a poisoned agent can read the NetBox inventory data the server exposes, bypassing the intended read-only boundary.
Attack vector
Missing authentication (CWE-306) on the NetBox MCP Server HTTP endpoint; an unauthenticated client that can reach the port obtains a valid MCP session and full access to all four NetBox tools without token or credentials.
Affected systems
netbox-mcp-server before 1.2.1 (TRANSPORT=http)
Mitigation
Upgrade to netbox-mcp-server 1.2.1 (GHSA-5qg7-j8mr-9477); don't expose the HTTP transport beyond trusted networks; require authentication for any MCP endpoint an agent reaches.