CVE-2026-107824: x64dbg-MCP Server Exposed All 71 Debugger Tools Unauthenticated on 0.0.0.0 (CVSS 4.0 9.3)

NVD published CVE-2026-107824 on 9 October 2026 with a CVSS 4.0 score of 9.3, from repository advisory GHSA-4478-h5jv-647m that the maintainer of duty1g/x64dbg-mcp-server had published on 24 August 2026 (credited to avishaigonen-pluto). The project is a native MCP plugin for the x64dbg debugger, used by reverse engineers and malware analysts to drive the debugger from an AI client over HTTP and SSE. Out of the box it required no authentication and listened on 0.0.0.0, on port 9094 (x64) and 9095 (x32), so any host that could reach the port got all 71 registered MCP tools: arbitrary x64dbg command execution, attaching to any process by PID, reading and patching debuggee memory, and writing files to arbitrary paths through the dump commands. The fix makes a bearer token mandatory, auto-generated on first run, and returns 401 without it. The sources disagree on the fixed version: the repository advisory says 1.0, NVD says 1.1. A separate advisory, GHSA-jgj3-97w2-9v9r (CVE-2026-107820, CVSS 5.3), is an unauthenticated Content-Length integer-overflow denial of service fixed in 1.2. Neither advisory is in the global GitHub Advisory Database, so dependency scanners will not flag them; no exploitation has been reported.

You are affected if you run x64dbg-MCP Server before 1.0 per the repository advisory (NVD says before 1.1); the related DoS is fixed in 1.2.. Versions 1.2 and later include the fix.

Upgrade x64dbg-MCP Server to 1.2 or later, which covers both the authentication fix (1.0 or 1.1, depending on the source) and the denial-of-service fix, and confirm that requests without the bearer token are refused with 401. Do not expose ports 9094 or 9095 beyond localhost: block them at the host firewall and look for listeners on those ports on analyst and reverse-engineering workstations. Keep the auto-generated token secret and give it only to the MCP client that needs it. If an unpatched instance was reachable from a network, treat the workstation and any process it could attach to as possibly compromised.

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run x and which version, then enforce a policy on it.