The vulnerability resides in the self‑hosted HTTP transport of DeepSeek MCP Server, where the POST /mcp endpoint is exposed without any authentication guard. An unauthenticated user can obtain a valid MCP session identifier, list available tools, and invoke local services such as deepseek_sessions or deepseek_chat. The deepseek_chat handler relies on a server‑side DEEPSEEK_API_KEY, meaning that once a session is created, the attacker can send requests that use the privileged key. The flaw is a classic missing‑authentication weakness (CWE‑306).

Affected installations are Arikusi DeepSeek MCP Server versions between 1.4.2 and 1.7.x, including the self‑hosted HTTP container images that publish port 3000 by default. These releases lack authentication checks on the POST /mcp endpoint, allowing unauthenticated session creation. The separately documented BYOK endpoint in the README requires an Authorization header and is not impacted. Version 1.8.0 and later contain a patch that enforces authentication on the self‑hosted HTTP endpoint.

The CVSS score of 5.3 signals moderate severity, and the EPSS score of less than one percent indicates a very low expected exploitation probability. The vulnerability is not listed in the CISA KEV catalog and is not known to be actively exploited. An attacker only needs network reachability to the server’s exposed port 3000 to interact with the endpoint; once connected, the exploitation path is trivial because the endpoint accepts requests without authentication and no further prerequisites are required.