CVE-2026-48989: Windows-MCP: HTTP transports expose unauthenticated PowerShell control with wildcard CORS

Synopsis

An authentication bypass vulnerability in Windows-MCP (the open-source AI-agent-to-Windows bridge) exposes an unauthenticated HTTP control plane to any network-reachable client. The server runs with wildcard CORS (allow_origins=*, allow_methods=*, allow_headers=*) and no credential requirement, so any origin or non-browser HTTP client can reach it directly. Successful exploitation gives the attacker full arbitrary PowerShell execution as the Windows user running Windows-MCP, enabling complete read, write, and denial-of-service capability on that host. No fix version has been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Windows-MCP HTTP server over the network; the service is exposed on a standard HTTP port and is reachable from any origin due to wildcard CORS configuration.

• AuthenticationNot required

  No credentials of any kind are required; the control plane is fully unauthenticated in affected versions.

• Victim interactionNot required

  The attacker contacts the server directly with no need for a victim to click a link or take any action.

• Attack complexityDetail

  Exploitation is straightforward and condition-free; no race conditions, memory-layout dependencies, or environmental factors need to be met.

Blast Radius

• The attacker executes arbitrary PowerShell commands as the Windows user running Windows-MCP, giving full read access to files, environment variables, and credentials stored on the host.
• The attacker can write, modify, or delete files and registry entries within the permissions of the running user account.
• The attacker can terminate processes, reconfigure services, or otherwise crash or disable the host environment, causing a denial of service.
• Because PowerShell can reach out to the network, the attacker can use the compromised host as a pivot point for lateral movement within the same environment.