CVE-2026-58446: Presenton MCP Server Authentication Bypass – CVSS 6.5

Technical summary

The vulnerability stems from a misconfiguration in the authentication chain for Presenton deployments. The nginx front-end is configured to enforce session authentication via auth_request directives for the main application, but this policy is not applied to the /mcp path where the bundled MCP server listens. The MCP server, upon receiving an unauthenticated request, automatically mints a valid internal session token for the default configured user (derived from AUTH_USERNAME environment variable). This bypasses the intended authentication layer entirely. The CWE-306 classification (Missing Authentication for Critical Function) reflects that a security-critical capability—invoking application tools and accessing configured API keys—lacks proper authentication enforcement. Authenticated users can invoke MCP tool handlers such as generate_presentation, which execute within the authenticated session context.

Business impact

An unauthenticated attacker can call authenticated MCP tools, leading to unauthorized consumption of the operator's LLM API quota (potentially causing unexpected costs or service degradation), creation of unwanted presentations within the operator's Presenton instance, and potential information disclosure through error messages or generated artifacts. The blast radius depends on deployment scope: internal-only deployments face lower external risk, but internet-exposed instances are vulnerable to opportunistic attacks. There is no data exfiltration vector in the disclosed attack surface, limiting impact to integrity and availability of the LLM service and presentation artifacts.

Affected systems

Presenton server and Docker deployments running versions prior to 0.8.8-beta with session authentication enabled (AUTH_USERNAME and AUTH_PASSWORD environment variables configured). Electron desktop builds are not vulnerable because they do not include the MCP server component. The vulnerability only manifests when the /mcp path is network-reachable; air-gapped or strictly firewalled deployments may have reduced practical exposure.

Exploitability

Exploitability is straightforward for internet-exposed instances. An attacker needs only network access to the /mcp endpoint and basic knowledge of the MCP protocol to craft tool invocation requests. No authentication credentials are needed, and the HTTP request can be constructed with standard tools (curl, Postman, custom scripts). The automatic session token minting means no brute-force or credential guessing is required. However, the attacker must know or guess the path (/mcp) and the available MCP tools; reconnaissance or public documentation would aid discovery. The attack is not in the current KEV catalog, suggesting active exploitation in the wild is not yet widespread or documented by CISA.

Remediation

Upgrade Presenton to version 0.8.8-beta or later, which is expected to restore proper authentication enforcement on the /mcp endpoint. Until patching is feasible, operators should immediately restrict network access to the /mcp path via firewall rules, network segmentation, or reverse proxy configuration (e.g., deny /mcp at the nginx level). Disable or remove the MCP server if it is not actively used. Audit LLM API key usage and presentation creation logs for any unauthorized activity during the window of exposure.

Patch guidance

Verify the Presenton release notes and vendor advisory for version 0.8.8-beta to confirm that authentication enforcement has been added to the /mcp path. Apply the upgrade in a staging environment first to test compatibility with your deployment configuration and MCP client integrations. Ensure nginx or reverse proxy configurations are reloaded after the update. If you are running a custom deployment or fork, manually apply the vendor's authentication fix to the MCP path (e.g., adding auth_request directives to nginx for /mcp).

Detection guidance

Monitor nginx access logs for unauthenticated requests to /mcp endpoints. Legitimate MCP clients should originate from known internal sources or be authenticated; unexpected external requests to /mcp are suspicious. Inspect application logs for calls to MCP tools (e.g., generate_presentation) that originate from unauthenticated or anomalous session tokens. Check LLM API quota usage for unexpected spikes or unusual presentation generation activity. Network-based detection tools can flag HTTP requests to /mcp lacking proper authentication headers or cookies if your monitoring rules are in place.

Why prioritize this

Although the CVSS score is MEDIUM (6.5), the ease of exploitation, lack of authentication requirements, and direct impact on operator LLM costs and service integrity warrant prompt prioritization. Internet-exposed instances should be patched or mitigated urgently. The lack of KEV designation suggests this may still be a low-volume, targeted attack vector, but public disclosure increases risk over time. Organizations relying on Presenton for mission-critical presentation generation should treat this as high priority.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects: Attack Vector: Network (AV:N)—remotely exploitable; Attack Complexity: Low (AC:L)—no special conditions; Privileges Required: None (PR:N)—no authentication needed; User Interaction: None (UI:N)—no user action required; Scope: Unchanged (S:U)—impact is confined to the vulnerable service; Confidentiality: None (C:N)—no data confidentiality breach; Integrity: Low (I:L)—unauthorized actions and presentation creation; Availability: Low (A:L)—LLM quota exhaustion and service degradation. The score does not account for business-specific factors such as the cost of LLM API consumption or the sensitivity of presentations in your environment.

Frequently asked questions