Payload CMS MCP plugin: Improper access control for MCP API keys
Summary
The MCP (Model Context Protocol) plugin of the Payload headless CMS allows an authenticated user to manage MCP API keys that belong to other accounts. This can lead to privilege escalation through account takeover. The attacker needs a valid user account on the affected installation, but no user interaction is required.
Affected
- @payloadcms/plugin-mcp from 3.61.0 before 3.88.0
- payloadcms/payload from 3.61.0 before 3.88.0 (listed by some CVE trackers; check both packages)
Fixed in
- Upgrade @payloadcms/plugin-mcp to 3.88.0 or later (fix commit 025581d8c5ed836039ad85397288a30f0d3c11c1)
Workaround
- Disable the MCP plugin until the upgrade is done
- Restrict MCP API key management to trusted users
Exploitation
- No evidence of exploitation in the wild found in the sources. Unknown whether the CISA KEV catalogue lists it; verify directly.
- No public proof-of-concept found.
- EPSS: 0.00252 (very low).
- The specific trigger conditions are not public.
Our recommendation
- Check all projects for @payloadcms/plugin-mcp and payload with npm ls.
- If the plugin is in use, upgrade to 3.88.0 or later; otherwise disable it.
- Review existing MCP API keys and user accounts for unexpected entries.
- Limit accounts to trusted users until patched.
- Monitor logs for unusual API key management activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-2q76-m6w6-qgc6 github.com
- Payload release v3.88.0 github.com
- Fix commit 025581d github.com
- GitHub Advisory GHSA-2q76-m6w6-qgc6 github.com
- OSV CVE-2026-105806 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:18.
Original description (NVD)
Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation through account takeover. This issue is fixed in version 3.88.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.