unifi-mcp: unauthenticated MCP HTTP exposure through insecure deployment defaults

criticalCVSS 10.0CWE-306

Vendor

sirkirby

Package

unifi-mcp pip

Affected

unifi-network-mcp < 0.32.4, unifi-protect-mcp < 0.8.6, unifi-access-mcp < 0.6.4, unifi-mcp-shared < 0.6.18

Fixed in

unifi-network-mcp 0.32.4, unifi-protect-mcp 0.8.6, unifi-access-mcp 0.6.4, unifi-mcp-shared 0.6.18

Disclosed

2026-09-08

Credit

Avishai Gonen

auth-bypassmissing-confirmationdockermcp