MCP Connect: Unauthenticated /bridge Endpoint Arbitrary Process Spawn RCE (GHSA-wvr4-3wq4-gpc5)

How the attack works

An attacker sends a POST request to the /bridge endpoint without any authentication, since the missing AUTH_TOKEN/ACCESS_TOKEN causes the auth middleware to skip its check entirely. The request body includes a serverPath field and an args array; if serverPath is not a URL (http(s) or ws(s)), the code treats it as a literal command to execute via StdioClientTransport. This lets the attacker name any binary present on the server (bash, python, powershell, etc.) as serverPath and supply arguments, causing the server to spawn that process. Public proof-of-concept exploits chain shell flags like -lc/-c with a command separator and a network tool to both run commands and exfiltrate data.

Netzilo detection

Why it matters

An attacker with network access to the /bridge endpoint gains full code execution on the host running MCP Connect, with no credentials needed — this can lead to complete server compromise, data theft, or further lateral movement.

What you can do

• →Set AUTH_TOKEN or ACCESS_TOKEN explicitly and verify the /bridge endpoint rejects requests without a valid token.
• →Restrict network access to the /bridge endpoint to trusted hosts only, e.g. via firewall rules or a reverse proxy requiring authentication.
• →Validate that serverPath only accepts http(s):// or ws(s):// URLs pointing to known MCP servers, and reject anything else at the application layer.
• →Review server logs for POST /bridge requests with non-URL serverPath values or suspicious args (shell flags, command separators, network utilities).

Known benign look-alikes

• A legitimate /bridge call whose serverPath is an http(s):// or ws(s):// URL pointing at a real MCP server.
• Security advisory or PR text quoting the GHSA-wvr4-3wq4-gpc5 PoC.
• A /bridge request body with a serverPath field that is empty or omitted.

References

• https://agentthreatrule.org/en/rules/ATR-2026-01985

Related threats