A flaw in Penpot versions before 2.18.0 causes the MCP server plugin WebSocket bridge to bind to all network interfaces without requiring authentication when the application runs in single‑user mode. An attacker on an adjacent network can connect to the exposed WebSocket port, masquerade as the legitimate Penpot browser plug‑in, intercept the data exchanged between the client and the MCP service, and return fabricated responses that the client believes originate from the server. This provides a form of authentication bypass that allows an unauthenticated actor to tamper with task payloads and results exchanged over the bridge.

Any deployment of Penpot that includes the MCP plugin and runs a version earlier than 2.18.0 is affected. This includes both the penpot/mcp component and the main Penpot application distributed by the Penpot project.

The CVSS score of 5.3 indicates moderate impact. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Because the WebSocket bridge is bound to all interfaces, the attack requires local or nearby network access; the attacker does not need privileged access to the target system. While the overall risk is moderate, it remains urgent to remediate as it permits unauthenticated tampering with data exchanged over the bridge.