MCP Connect: Unauthenticated /bridge Endpoint Arbitrary Process Spawn RCE (GHSA-wvr4-3wq4-gpc5) - ATR-2026-01985 (32fe7945-ba88-500e-bcdc-a6983d36bb53)
Detects GHSA-wvr4-3wq4-gpc5 (CWE-306, CVSS critical): MCP Connect (mcp-bridge) ships with AUTH_TOKEN/ACCESS_TOKEN unset by default, which makes authToken an empty string and short-circuits the auth middleware in src/server/http-server.ts (the guard is wrapped in if (this.accessToken), which is skipped when the token is falsy, so next() is always reached). The unauthenticated POST /bridge endpoint then extracts serverPath and args straight from the request body and passes them to MCPClientManager.createClient(), which falls through to StdioClientTransport for any value that is not an http(s)/ws(s) URL, using serverPath as the executable command verbatim (src/client/mcp-client-manager.ts lines 68-75). Any binary reachable on the server's PATH (bash, sh, python, node, cmd, powershell, ...) can be launched with attacker-controlled args, giving unauthenticated remote code execution.
Detection covers: (a) a POST /bridge request body whose serverPath names a shell/OS binary
(not an http(s)/ws(s) MCP server URL) combined with an args array —
the arbitrary-process-spawn shape;
(b) the PoC's chained shell-exec/exfiltration args pattern (-lc / -c
combined with a command separator and a network egress binary);
(c) explicit GHSA-wvr4-3wq4-gpc5 / mcp-bridge exploitation framing tied to
serverPath and /bridge.
A legitimate /bridge call whose serverPath is an http(s):// or ws(s):// URL pointing at an actual MCP server does NOT match — that is the intended StdioClientTransport bypass path, not the executable-spawn primitive.