CVE-2026-48989 Windows-MCP: HTTP transports expose unauthenticated PowerShell control with wildcard CORS
Attackers can execute arbitrary PowerShell commands via unauthenticated HTTP endpoints with wildcard CORS in Windows-MCP.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48989?
CVE-2026-48989 is a high-severity missing authorization vulnerability in CursorTouch Windows-MCP, published on 17 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Windows-MCP is an open-source project that integrates AI agents with Windows. In versions prior to 0.7.5, certain HTTP modes exposed the MCP control plane without authentication while enabling wildcard CORS (allow_origins=*, allow_methods=*, allow_headers=*). Because the same server also exposed a PowerShell tool that executes caller-controlled commands as the Windows user running Windows-MCP, attackers could reach the control plane from arbitrary origins or non-browser clients and achieve arbitrary PowerShell execution. This issue was fixed in version 0.7.5.
Weakness: CWE-306
Which versions are affected by CVE-2026-48989?
3 open source packages ship an affected version, including windows-mcp.
| Package | Affected | Fixed in |
|---|---|---|
windows-mcp PyPI | All versions | 0.7.5 |
windows-mcp PyPI | All versions | 0.7.5 |
windows-mcp PyPI | All versions | 0.7.5 |
How do I fix CVE-2026-48989?
Upgrade windows-mcp to 0.7.5 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-48989 being exploited?
There is no known exploitation of CVE-2026-48989 in the wild and no public exploit code.
Sources
Also known as GHSA-vrxg-gm77-7q5g, PYSEC-2026-3425.