Hide Navigation
Hide TOC
Windows-MCP Unauthenticated HTTP PowerShell via Wildcard CORS (CVE-2026-48989) - ATR-2026-01986 (0e1e759f-f795-55d4-b677-11bda103401d)
Detects CVE-2026-48989 / GHSA-vrxg-gm77-7q5g (CWE-306 Missing Authentication for Critical Function): Windows-MCP's SSE and Streamable HTTP transports build the FastMCP control plane with no auth provider (src/windows_mcp/main.py:75-113) and install blanket wildcard CORS (allow_origins=, allow_methods=, allow_headers=*, main.py:37-42), answering every OPTIONS preflight with the same wildcard headers regardless of Origin. The same server registers the PowerShell tool (src/windows_mcp/tools/shell.py:10-24), which executes caller-controlled commands via PowerShell -EncodedCommand (src/windows_mcp/desktop/powershell.py:176-204). A client that can reach http://:/mcp — including a cross-origin browser page, since the wildcard CORS grants it — can initialize an MCP session and call tools/call for PowerShell with no credential of any kind, achieving arbitrary PowerShell execution as the Windows user running Windows-MCP. Affected: CursorTouch/Windows-MCP < 0.7.5; the default stdio transport is not affected.
Detection covers: (a) the OPTIONS preflight / control-plane response on the /mcp endpoint
carrying the wildcard access-control-allow-origin marker, which is the
structural precondition for the cross-origin bypass;
(b) a tools/call JSON-RPC request naming the PowerShell tool over the
HTTP/SSE control plane co-occurring with that wildcard-CORS marker;
(c) explicit CVE-2026-48989 / GHSA-vrxg-gm77-7q5g exploitation framing.
The detection target is the request/response shape at the MCP control plane — a PowerShell tool invocation reachable through an unauthenticated, wildcard-CORS-exposed /mcp endpoint — which is the exact remote-code- execution primitive, caught before PowerShellExecutor.execute_command runs. Bound to the PowerShell tool name plus the wildcard-CORS marker so a legitimate, authenticated PowerShell call over a properly-scoped-CORS deployment does not fire.