Vulnerability · Published Sep 27, 2026 · Assigned by VulnCheck
CVE-2026-100868Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridge
Medium 6.3
In plain English
A medium-severity security flaw in penpot from penpot. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.5%top 54.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return forged results to the MCP client.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| penpot | penpot | 0 – before 2.18.0 |
| penpot | @penpot/mcp | 0 – through 2.15.4 |
Weakness: CWE-1327 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
References
- GitHub Security Advisory (GHSA-ch2q-6x56-qg5r) vendor-advisory
- https://github.com/penpot/penpot/commit/b5274a44766d095247037be18c1d1918ac67ddeb patch
- https://github.com/penpot/penpot/blob/1d2c37e52c733f74017d90b0fd1ae2d074a5c33d/mcp/packages/server/src/PluginBridge.ts#L52 technical-description
- GitHub Security Advisory (GHSA-22qr-rp27-j9wm) related, vendor-advisory
- https://github.com/penpot/penpot product
- VulnCheck Advisory: Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridge third-party-advisory