CVE-2026-61542: Gearboy: Missing authentication in embedded MCP HTTP server

Summary

Gearboy, a Game Boy emulator and debugger, has an optional MCP HTTP mode that accepts unauthenticated requests from any reachable network peer. The server listens on all interfaces by default and does not enforce authorization, Host or Origin checks, so a peer on the same network can start an MCP session and invoke emulator and debugging functions. The reported impact is limited to the emulator process, debugging state and local media files; host code execution is not demonstrated. Exploitation requires the MCP HTTP mode to be enabled and the host to be reachable from the network.

Affected

drhelius Gearboy versions before 3.8.7
Only installations started with the --mcp-http option are affected

Fixed in

Upgrade to Gearboy 3.8.7 or later (fix commit e2ead98e2fac41e9df5a499e9e421c6a0e73f1bc)
The vendor's 3.8.7 release notes do not explicitly mention the security fix; verify via the GitHub security advisory

Workaround

Do not start Gearboy with --mcp-http
If MCP HTTP mode is required, block TCP port 7777 (default) at the host firewall for network access
Set GEARBOY_MCP_HTTP_TOKEN and use the loopback default bind address (vendor 3.8.7 documentation)

Exploitation

No evidence of active exploitation known at the time of research
Not listed in CISA KEV
No public exploit code found in major sources; one aggregator lists an unverified PoC entry

Our recommendation

Inventory endpoints for Gearboy and upgrade to 3.8.7 or later
Disable --mcp-http on workstations unless needed
Do not allow the MCP port through office networks
Prioritise low, as Gearboy is a hobbyist tool and not typically found on business servers

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

GitHub Security Advisory GHSA-fmvx-487g-mrww github.com
Fix commit e2ead98 github.com
Gearboy 3.8.7 release github.com
VulDB CVE-2026-61542 vuldb.com
OffSeq radar CVE-2026-61542 radar.offseq.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:53.

Original description (NVD)

Gearboy is a Game Boy, Game Boy Color, and Super Game Boy emulator and debugger with an embedded MCP server. Gearsystem, the affected component, has an optional `--mcp-http` mode that accepts unauthenticated MCP requests from any reachable network peer despite localhost-only documentation and logging. In the described `platforms/shared/desktop/mcp/mcp_transport.h` transport, the socket binds `INADDR_ANY`, normally on port 7777, and POST requests to `/mcp` reach dispatch without `Authorization`, `Host`, or `Origin` checks. Responses and OPTIONS advertise `Access-Control-Allow-Origin: *`. A peer can initialize an MCP session and invoke exposed emulator/debugging operations; even a garbage bearer token does not block dispatch, while a loopback-bind negative control prevents network access. The reported impact is bounded to the emulator process, debugging state, and local files accepted as media, rather than demonstrated host code execution. Gearboy 3.8.7 contains a patch.

NVD references (3)

Sources

The tracker combines official, freely usable data sources – updated continuously:

NVD (NIST) – CVEs, rating (CVSS), affected products
CISA KEV – vulnerabilities confirmed by CISA as actively exploited
CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
FIRST EPSS – probability of exploitation
Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
PoC-in-GitHub – public proof-of-concept repositories
Metasploit (Rapid7) – modules of the Metasploit Framework
Exploit-DB (OffSec) – archive of public exploits (links only)
Patch days: official vendor pages (linked per vendor) (Vendor patch days)

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touch RSS feed