Skip to content

Hide Navigation Hide TOC

Windows-MCP Unauthenticated HTTP PowerShell via Wildcard CORS (CVE-2026-48989) - ATR-2026-01986 (0e1e759f-f795-55d4-b677-11bda103401d)

Detects CVE-2026-48989 / GHSA-vrxg-gm77-7q5g (CWE-306 Missing Authentication for Critical Function): Windows-MCP's SSE and Streamable HTTP transports build the FastMCP control plane with no auth provider (src/windows_mcp/main.py:75-113) and install blanket wildcard CORS (allow_origins=, allow_methods=, allow_headers=*, main.py:37-42), answering every OPTIONS preflight with the same wildcard headers regardless of Origin. The same server registers the PowerShell tool (src/windows_mcp/tools/shell.py:10-24), which executes caller-controlled commands via PowerShell -EncodedCommand (src/windows_mcp/desktop/powershell.py:176-204). A client that can reach http://:/mcp — including a cross-origin browser page, since the wildcard CORS grants it — can initialize an MCP session and call tools/call for PowerShell with no credential of any kind, achieving arbitrary PowerShell execution as the Windows user running Windows-MCP. Affected: CursorTouch/Windows-MCP < 0.7.5; the default stdio transport is not affected. Detection covers: (a) the OPTIONS preflight / control-plane response on the /mcp endpoint carrying the wildcard access-control-allow-origin marker, which is the structural precondition for the cross-origin bypass; (b) a tools/call JSON-RPC request naming the PowerShell tool over the HTTP/SSE control plane co-occurring with that wildcard-CORS marker; (c) explicit CVE-2026-48989 / GHSA-vrxg-gm77-7q5g exploitation framing. The detection target is the request/response shape at the MCP control plane — a PowerShell tool invocation reachable through an unauthenticated, wildcard-CORS-exposed /mcp endpoint — which is the exact remote-code- execution primitive, caught before PowerShellExecutor.execute_command runs. Bound to the PowerShell tool name plus the wildcard-CORS marker so a legitimate, authenticated PowerShell call over a properly-scoped-CORS deployment does not fire.

Cluster A Galaxy A Cluster B Galaxy B Level
LLM Plugin Compromise (adbb0dd5-ff66-4b2f-869f-bfb3fdb45fc8) MITRE ATLAS Attack Pattern Windows-MCP Unauthenticated HTTP PowerShell via Wildcard CORS (CVE-2026-48989) - ATR-2026-01986 (0e1e759f-f795-55d4-b677-11bda103401d) Agent Threat Rules 1
Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830) Attack Pattern Windows-MCP Unauthenticated HTTP PowerShell via Wildcard CORS (CVE-2026-48989) - ATR-2026-01986 (0e1e759f-f795-55d4-b677-11bda103401d) Agent Threat Rules 1
Windows-MCP Unauthenticated HTTP PowerShell via Wildcard CORS (CVE-2026-48989) - ATR-2026-01986 (0e1e759f-f795-55d4-b677-11bda103401d) Agent Threat Rules Exploit Public-Facing Application - T1190 (3f886f2a-874f-4333-b794-aa6075009b1c) Attack Pattern 1