CVE-2026-48989 Overview
CVE-2026-48989 affects Windows-MCP, an open-source project that integrates AI agents with Windows. Versions prior to 0.7.5 expose the Model Context Protocol (MCP) control plane over HTTP without authentication. The server simultaneously enables wildcard Cross-Origin Resource Sharing (CORS) with allow_origins=*, allow_methods=*, and allow_headers=*. The same server exposes a PowerShell tool that executes caller-supplied commands as the Windows user running Windows-MCP. Attackers can reach the control plane from arbitrary origins or non-browser clients and achieve arbitrary PowerShell execution. The maintainers fixed the issue in version 0.7.5.
Critical Impact
Unauthenticated network attackers can execute arbitrary PowerShell commands in the security context of the Windows-MCP user, leading to full host compromise.
Affected Products
- Windows-MCP versions prior to 0.7.5
- HTTP transport modes of Windows-MCP exposing the MCP control plane
- Windows hosts running Windows-MCP with the PowerShell tool enabled
Discovery Timeline
- 2026-06-17 - CVE-2026-48989 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-48989
Vulnerability Analysis
The vulnerability is a Missing Authentication for Critical Function flaw [CWE-306]. Windows-MCP exposes an MCP control plane over HTTP without any authentication layer in vulnerable releases. The same HTTP server registers a PowerShell tool that runs caller-controlled commands on the host. Because the control plane accepts any request, any client that can reach the listener can invoke the PowerShell tool. The combination of missing authentication and a code-execution tool collapses the trust boundary between remote callers and the local shell.
Root Cause
The MCP server binds an HTTP listener that does not validate caller identity or possession of a shared secret. The server also applies a permissive CORS policy with wildcard origins, methods, and headers. The wildcard policy instructs browsers to allow cross-origin requests from any web page. Non-browser clients ignore CORS entirely and can call the endpoint directly. Neither path requires credentials, so the PowerShell tool is reachable by any unauthenticated caller that can route packets to the listener.
Attack Vector
An attacker reaches the Windows-MCP HTTP endpoint over the network or from a malicious web origin loaded in a browser on the victim host. The attacker sends an MCP request invoking the PowerShell tool with a chosen command string. The server executes the command as the Windows user running Windows-MCP. The attacker can install persistence, exfiltrate files, harvest credentials, or pivot to other hosts. See the GitHub Security Advisory GHSA-vrxg-gm77-7q5g for the maintainer description.
Detection Methods for CVE-2026-48989
Indicators of Compromise
- Unexpected powershell.exe or pwsh.exe child processes spawned by the Windows-MCP host process.
- HTTP requests to the Windows-MCP listener from external IP addresses or unexpected browser origins.
- Outbound network connections from PowerShell processes that share a parent with Windows-MCP.
- New scheduled tasks, services, or registry Run keys created shortly after Windows-MCP HTTP traffic.
Detection Strategies
- Hunt for PowerShell command lines containing encoded payloads (-EncodedCommand, -enc) descending from the Windows-MCP process tree.
- Inspect HTTP access logs for the MCP listener and flag requests with Origin headers that do not match approved internal tools.
- Correlate MCP tool-invocation events with subsequent process creation, file write, and network connection telemetry.
Monitoring Recommendations
- Enable PowerShell Script Block Logging (Event ID 4104) and Module Logging on hosts running Windows-MCP.
- Forward Sysmon Event ID 1 (process creation) and Event ID 3 (network connection) to a centralized analytics platform.
- Alert on any listener bound by Windows-MCP that accepts connections from non-loopback interfaces.
How to Mitigate CVE-2026-48989
Immediate Actions Required
- Upgrade Windows-MCP to version 0.7.5 or later on every host running the server.
- Restrict the Windows-MCP HTTP listener to 127.0.0.1 until the upgrade is complete.
- Block inbound access to Windows-MCP listener ports at the host firewall and perimeter.
- Audit recent process creation and network logs for signs of PowerShell tool abuse.
Patch Information
The maintainers fixed CVE-2026-48989 in Windows-MCP version 0.7.5. Patch artifacts and release notes are available in the GitHub Release v0.7.5. Review the GitHub Security Advisory GHSA-vrxg-gm77-7q5g for the full advisory and configuration guidance.
Workarounds
- Disable HTTP transport modes and use a local-only transport such as stdio where supported.
- Place Windows-MCP behind an authenticating reverse proxy that enforces mutual TLS or bearer tokens.
- Remove or disable the PowerShell tool registration if the deployment does not require shell execution.
- Run Windows-MCP under a low-privilege Windows account with constrained file system and network rights.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
