The mcp‑router CLI, prior to version 0.6.3, runs its MCP Aggregator service on the all‑interfaces IP address and only performs authentication when the user explicitly supplies a token flag. As a result, a default run will expose both the aggregator and any MCP servers it fronts to anyone who can reach the configured port. The flaw allows an unauthenticated attacker to connect, potentially read data or issue commands against the aggregated services, and is classified as an authentication bypass, CWE‑306.

All installations of the mcp‑router CLI package before release 0.6.3 are affected. The vulnerability applies to every pre‑0.6.3 build, regardless of operating system or deployment environment, because the host value defaulted to the wildcard address and no authentication check was performed. Starting with v0.6.3, the host defaults to 127.0.0.1 and the process refuses to start on non‑loopback interfaces unless a token is supplied.

The CVSS score of 9.3 indicates critical severity. An attacker only needs network reachability to the exposed port; no additional privileges are required. Because the flaw requires no authentication, exploitation is trivial. EPSS data is not available, but the vulnerability is not yet listed in the CISA KEV catalog. The attack vector is likely remote, though local networks can also target the service. Given the high CVSS and ease of exploitation, the risk is significant.