Another MCP server left wide open: anyone on the network could drive a debugger

A critical flaw, CVE-2026-107824, rated 9.3 out of 10, affects the x64dbg MCP server, a plugin that lets ai agents drive the x64dbg debugger.

Before version 1.1, it exposed every debugger tool over the network with no authentication, listening on all interfaces by default. Anyone who could reach it could run commands, attach to running programs, read and rewrite their memory, and write files.

A second flaw, CVE-2026-107820 (rated 5.3), is fixed in version 1.2.

Why it matters

The pattern keeps repeating: bolt an MCP server onto a powerful tool, open it to the whole network, and skip the login. A debugger can read and change a running program's memory, so an open door here is a serious one.