Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Presenton before 0.8.8-beta bundles an MCP server that, on server/Docker deployments configured with session authentication (AUTH_USERNAME/AUTH_PASSWORD), is reachable unauthenticated at /mcp because the nginx front-end does not apply the auth_request gate to that path and the MCP server auto-mints a valid internal session token for the configured user. A remote unauthenticated attacker can invoke MCP tools such as generate_presentation, performing authenticated application actions, consuming the operators configured LLM API keys, and creating presentations in the operators instance. The Electron desktop build is not affected (MCP disabled).
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-58446 Unauthenticated MCP Server Access in Presenton Before 0.8.8-beta https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-58446
Post summary
The post announces CVE‑2026‑58446—unauthenticated MCP Server access in Presenton before 0.8.8‑beta—without offering technical details, exploit code, or mitigation information.
🚨*CVE* CVE-2026-58446 Presenton before 0.8.8-beta bundles an MCP server that, on server/Docker deployments configured with session authentication (AUTH_USERNAME/AUTH_PASSWORD), is reachabl… https://www.cve.org/CVERecord?id=CVE-2026-58446 ----- Traducción: CVE-2026-58446 Pre… http://infoflow.cloud`
Post summary
The post provides a brief disclosure of CVE-2026-58446, noting an exposed MCP server in certain deployments, but offers no PoC, exploit, or patch details.
CVE-2026-58446 Presenton before 0.8.8-beta bundles an MCP server that, on server/Docker deployments configured with session authentication (AUTH_USERNAME/AUTH_PASSWORD), is reachabl… https://www.cve.org/CVERecord?id=CVE-2026-58446
Post summary
The entry briefly notes CVE-2026-58446 in version 0.8.8-beta of Presenton, indicating a bundled MCP server that might be reachable when session authentication is set on Docker deployments, but offers no further detail.