x64dbg-MCP Server: Missing authentication in HTTP/SSE interface

Summary

The x64dbg-MCP Server plugin exposes all of its debugger tools over HTTP and SSE without authentication and listens on 0.0.0.0 by default. Any network client that can reach port 9094 (x64) or 9095 (x32) can run arbitrary x64dbg commands, attach to processes by PID, read and write debuggee memory, and write files to arbitrary paths. No valid credentials are needed, so the risk is mainly on analyst workstations running x64dbg with the plugin.

Affected

• duty1g x64dbg-mcp-server before 1.1 (CNA data)
• VulDB lists versions up to 1.0 as affected, which is consistent with the fix in 1.1

Fixed in

• Version 1.1 (commit 1aad0f8 makes Bearer token authentication mandatory on every request)

Workaround

• Block or restrict TCP ports 9094 and 9095 on the host firewall
• Bind the server to 127.0.0.1 only, if the version allows it
• Do not run the plugin on hosts that hold sensitive data or on network segments with untrusted hosts

Exploitation

• CISA SSVC: exploitation none, automatable yes, technical impact total
• No public proof of concept or confirmed exploitation found in the research
• EPSS 0.00403 (very low)

Our recommendation

• Find hosts with x64dbg and the plugin files (x64dbg-MCP-Server.dp32 or .dp64) in the plugins folder
• Upgrade to the latest release, not only 1.1, because newer releases exist
• Confirm that the server binds only to localhost and that token authentication is enabled
• Block ports 9094 and 9095 from the network until patched

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub commit 1aad0f8: Make Bearer token authentication mandatory github.com
• GitHub commit e1daba0: Add Bearer token authentication github.com
• GitHub release v1.1 github.com
• GitHub security advisory GHSA-4478-h5jv-647m github.com
• OSV: CVE-2026-107824 osv.dev
• VulDB entry 415988 vuldb.com
• Vulners (Rapid7): CVE-2026-107824 vulners.com
• GitHub project releases github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:38.