~ / search / GHSA-2q76-m6w6-qgc6

GHSA-2q76-m6w6-qgc6

Payload: Improper access control for MCP API keys

Source: GitHub Advisory Database (reviewed) High CVE-2026-105806

Packages

EcosystemPackageAffectedFixed in
npm @payloadcms/plugin-mcp >= 3.61.0, < 3.88.0 3.88.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Under certain conditions, an authenticated user could manage MCP API keys outside their intended account allowing an attacker to escalate privileges through account takeover. Applications that do not use `@payloadcms/plugin-mcp` are not affected. ### Patches Users should upgrade to `@payloadcms/plugin-mcp` version `3.88.0` or later. ### Workarounds Upgrading is recommended. Until then, disable the MCP plugin or restrict MCP API-key management to trusted users.

References

External links from the advisory. They lead to third-party sites.