CVE-2026-58446: Presenton Authentication Bypass Vulnerability

CVE-2026-58446 Overview

CVE-2026-58446 is an authentication bypass vulnerability in Presenton versions before 0.8.8-beta. The flaw affects server and Docker deployments configured with session authentication using AUTH_USERNAME and AUTH_PASSWORD. The bundled Model Context Protocol (MCP) server is reachable unauthenticated at /mcp because the nginx front-end omits the auth_request gate on that path. The MCP server also auto-mints a valid internal session token for the configured user. A remote unauthenticated attacker can invoke MCP tools such as generate_presentation, consume operator-configured LLM API keys, and create presentations. The Electron desktop build is not affected because MCP is disabled there. The issue is tracked as CWE-306 Missing Authentication for Critical Function.

Critical Impact
Remote unauthenticated attackers can invoke MCP tools, execute authenticated application actions, and drain the operator's configured LLM API keys.

Affected Products

Presenton server deployments before 0.8.8-beta
Presenton Docker deployments before 0.8.8-beta configured with session auth (AUTH_USERNAME/AUTH_PASSWORD)
Presenton Electron desktop build is NOT affected (MCP disabled)

Discovery Timeline

2026-06-30 - CVE-2026-58446 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-58446

Vulnerability Analysis

Presenton bundles an MCP server that exposes tool endpoints under /mcp. On server and Docker deployments, nginx acts as the front-end reverse proxy and enforces session authentication via an auth_request directive on protected routes. The /mcp location block did not include this directive, leaving MCP tools reachable without a valid session. The MCP server compounded the issue by auto-minting a valid internal session token for the configured user, so downstream authorization checks passed regardless of caller identity. Attackers can invoke tools such as generate_presentation and perform authenticated actions inside the operator's instance.

Root Cause

The root cause is Missing Authentication for a Critical Function [CWE-306]. The nginx configuration did not gate /mcp/ with auth_request, and the MCP backend trusted requests reaching it by minting a session token for the configured user. Perimeter and application layers both failed to enforce authentication on the MCP path.

Attack Vector

The vulnerability is exploitable over the network with no privileges and no user interaction. An attacker sends unauthenticated MCP protocol requests to /mcp on a reachable Presenton deployment and invokes the exposed tools. Successful exploitation consumes operator-configured LLM API keys and creates presentations inside the operator's instance.

text

# Security patch in nginx.conf
# Source: https://github.com/presenton/presenton/commit/a1103dcef3c761cc8bab44e2862c81a49969abd7

    # MCP
    location /mcp/ {
+     auth_request /_auth_check;
      proxy_pass http://localhost:8001/mcp/;
      proxy_read_timeout 30m;
      proxy_connect_timeout 30m;

The patch adds the auth_request /_auth_check; directive to the /mcp/ location, forcing nginx to validate the session before proxying to the MCP server.

Detection Methods for CVE-2026-58446

Indicators of Compromise

Unauthenticated HTTP requests to /mcp or /mcp/ endpoints on Presenton deployments
Invocations of MCP tools such as generate_presentation from unexpected source IPs
Unexplained spikes in outbound calls to configured LLM providers (OpenAI, Anthropic, others) tied to the Presenton service account
New presentation artifacts created in the Presenton instance without a corresponding authenticated user session

Detection Strategies

Inspect nginx access logs for POST and GET requests to /mcp* paths lacking prior /api/v1/auth session establishment
Correlate LLM API key usage metrics with authenticated Presenton user activity to surface tool calls attributable to unauthenticated sessions
Alert on MCP tool invocations originating from IPs outside expected administrative or automation ranges

Monitoring Recommendations

Enable verbose access logging on the nginx front-end and forward logs to a centralized SIEM or data lake for retention
Monitor LLM provider billing dashboards and API rate metrics for anomalous consumption
Track Presenton application logs for tool invocations that do not map to interactive user sessions

How to Mitigate CVE-2026-58446

Immediate Actions Required

Upgrade Presenton to version 0.8.8-beta or later, which adds the auth_request gate to /mcp/ and returns the session token via the authenticated login response
Restrict network exposure of Presenton so /mcp is unreachable from untrusted networks pending patching
Rotate any LLM API keys configured in Presenton if unauthenticated access is suspected
Review presentation artifacts and MCP tool invocation logs for unauthorized activity

Patch Information

The fix is committed in presenton commit a1103dc and released as electron-v0.8.8-beta. See the GitHub pull request 679, issue 678, and the VulnCheck Security Advisory for full technical context. The patch also updates servers/fastapi/api/v1/auth/router.py to return an explicit access_token and token_type in the login response so MCP clients present a proper bearer token instead of relying on the auto-minted internal token.

Workarounds

Block /mcp and /mcp/ at an upstream reverse proxy or WAF until the upgrade is applied
Bind the Presenton service to a private network interface and require VPN or bastion access for administrators
Disable MCP functionality where it is not required by the deployment

bash

# Emergency nginx workaround: deny /mcp until patched
location /mcp/ {
    deny all;
    return 403;
}