Vulnerability · Published Oct 9, 2026 · Assigned by GitHub_M
CVE-2026-107824x64dbg-MCP Server exposes debugger operations to unauthenticated network clients
Critical 9.3
In plain English
A critical-severity missing authentication in x64dbg-mcp-server from duty1g. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).
Official description
x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.1, x64dbg-MCP Server exposes all MCP debugger tools over HTTP and SSE without authentication while listening on 0.0.0.0 by default. Any unauthenticated network client that can reach the default port, 9094 for x64 or 9095 for x32, can execute arbitrary x64dbg commands, attach to processes by PID, read and write debuggee memory, and write files to arbitrary paths. This issue is fixed in version 1.1.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| duty1g | x64dbg-mcp-server | < 1.1 |
Weakness: CWE-306 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://github.com/duty1g/x64dbg-mcp-server/security/advisories/GHSA-4478-h5jv-647m x_refsource_CONFIRM
- https://github.com/duty1g/x64dbg-mcp-server/security/advisories/GHSA-jgj3-97w2-9v9r x_refsource_MISC
- https://github.com/duty1g/x64dbg-mcp-server/commit/1aad0f88b9c27233d11dbccf08ca415eb5f49203 x_refsource_MISC
- https://github.com/duty1g/x64dbg-mcp-server/commit/e1daba0038959f88d25ff3376b2a7f922ffeb448 x_refsource_MISC
- https://github.com/duty1g/x64dbg-mcp-server/releases/tag/1.0 x_refsource_MISC
- https://github.com/duty1g/x64dbg-mcp-server/releases/tag/v1.1 x_refsource_MISC