Windows-MCP Unauthenticated HTTP PowerShell via Wildcard CORS (CVE-2026-48989)
Windows-MCP is a tool that lets AI agents control a Windows machine. Versions before 0.7.5 expose a network endpoint that requires no authentication and accepts requests from any website due to wildcard CORS settings, letting a remote attacker — even a malicious webpage a user simply visits — run arbitrary PowerShell commands on the host.
How the attack works
When run with the SSE or Streamable HTTP transport, Windows-MCP starts a control-plane endpoint (/mcp) with no authentication provider and CORS headers that allow any origin, method, and header. An attacker's browser page or script sends a CORS preflight request, gets back the wildcard approval, then opens an MCP session and calls the PowerShell tool directly. Because there is no credential check anywhere in this path, the command runs immediately as the Windows user hosting the server. This only affects the HTTP/SSE transports; the default stdio transport is not reachable this way.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 303021f4-df2a-49fa-8d30-86b1e4feba57
- Severity
- Critical
- CVEs
- CVE-2026-48989
Why it matters
An attacker who can reach the /mcp port, including via a victim's browser visiting a malicious page, gets arbitrary command execution on the Windows host as the user running Windows-MCP — full compromise of that machine.
What you can do
- →Upgrade Windows-MCP to 0.7.5 or later.
- →Do not expose the SSE/Streamable HTTP transport to untrusted networks; prefer the stdio transport where possible.
- →If HTTP transport is required, put an authentication provider in front of it and scope CORS to specific trusted origins instead of wildcard.
- →Audit any existing deployments for wildcard Access-Control-Allow-Origin headers on /mcp and for unauthenticated PowerShell tool calls in logs.
Known benign look-alikes
- A legitimate, authenticated PowerShell tool call over stdio transport or an HTTP deployment with an auth provider and origin-scoped CORS configured — expected to match if wildcard CORS markers are also present; review confirms intent.
- Security advisory or PR text quoting the GHSA-vrxg-gm77-7q5g / CVE-2026-48989 PoC for review purposes.
- An OPTIONS preflight response that scopes Access-Control-Allow-Origin to a specific trusted origin rather than a wildcard.