Medium severity · published Sep 27, 2026
CVE-2026-100868
Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridge
6.3
CVSS
0.5%
EPSS
No
On KEV
Description
Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return forged results to the MCP client.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PE
@penpot/mcp · penpot
through 2.15.4 · source: vendor
PE
penpot · penpot
before 2.18.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-100868
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-100868
vendor-advisory
https://github.com/penpot/penpot/security/advisories/GHSA-ch2q-6x56-qg5r
patch
https://github.com/penpot/penpot/commit/b5274a44766d095247037be18c1d1918ac67ddeb
technical-description
https://github.com/penpot/penpot/blob/1d2c37e52c733f74017d90b0fd1ae2d074a5c33d/mcp/packages/server/src/PluginBridge.ts#L52
related
https://github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm
product
https://github.com/penpot/penpot
third-party-advisory
https://www.vulncheck.com/advisories/penpot-before-2.18.0-unauthenticated-websocket-access-via-mcp-bridge