# GHSA-52cq-7v8r-62c6: gmaps-mcp's unauthenticated HTTP transport allows unlimited Google Maps API calls at operator expense

> Unauthenticated access to the default HTTP transport allows attackers to generate unlimited billed Google Maps API calls, causing financial loss to the operator.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 8 May 2026

## What is GHSA-52cq-7v8r-62c6?

GHSA-52cq-7v8r-62c6 is a missing authorization vulnerability in gmaps-mcp, published on 8 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

## Unauthenticated HTTP Transport Allows Unlimited Google Maps API Calls at Operator Expense

The `gmaps-mcp` codebase was reviewed at commit `e671db68c804c9e67d51582d3280839ffa65f127` and three issues worth flagging were discovered — one high-severity, one medium, one structural. There were no preexisiting CVEs for this package yet and the repository had no prior security issues.

The primary issue is that the HTTP transport in `server.py` skips authentication entirely when `MCP_API_KEY` is not set — which is the default, since `.env.example` ships the key as a blank value. Any unauthenticated caller who knows the server's public URL can invoke all six tools and generate live, billed Google Maps API requests against the operator's key. Because the README explicitly instructs operators to expose the server via ngrok (`ngrok http 8000`, then point MCP clients at the ngrok URL), this configuration gets deployed internet-facing as a matter of normal usage.

**Affected files and exact lines:**

`src/google_maps_mcp/server.py`, lines 186–192:
```python
expected_key = os.getenv("MCP_API_KEY")

if not expected_key:
    # If no MCP_API_KEY is set, allow all requests (development mode)
    return await call_next(request)

if api_key != expected_key:
    return JSONResponse(
        {"error": "Invalid or missing API key. Provide X-API-Key header."},
        status_code=401
    )
```

`run.py` lines 37 and 38 bind to `0.0.0.0:8000` by default (`MCP_HOST=0.0.0.0`, `MCP_PORT=8000`). No rate-limiting middleware exists anywhere in the codebase — not in the middleware stack, not in `GoogleMapsClient`, not in the tool handlers.

**Attack model:** operator deploys with default config (blank `MCP_API_KEY`), exposes via ngrok per the README instructions, attacker discovers the ngrok URL through ngrok's public endpoint scan surface or via a targeted test of shared URLs. No credentials needed to call the server.

**PoC — reproduces from the default config:**
```bash
# Start with default .env.example (MCP_API_KEY blank/unset)
export GOOGLE_MAPS_API_KEY=<operator_key>
python run.py  # binds 0.0.0.0:8000

# From attacker machine — no X-API-Key header needed:
curl -X POST http://<server>:8000/mcp/ \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"geocode","arguments":{"address":"Times Square New York"}}}'
# Returns geocoding results. Request billed to operator's GCP project.
```

The financial harm is real and accumulates fast. Google's $200/month free credit exhausts in roughly 3 hours at Places API pricing (~$17/1,000 requests) with a sustained 1 req/sec flood. More practically: any developer testing the ngrok URL, sharing it in a project thread, or posting it in a demo context creates a window where anyone with the link can silently drain quota. The attacker doesn't need the `GOOGLE_MAPS_API_KEY` value — they only need the MCP server URL.

**Fix — three concrete changes, no new dependencies:**

1. In HTTP transport mode, refuse to start if `MCP_API_KEY` is unset. Add a startup check in `server.py` (or `run.py`) that exits with a clear message if the environment variable is blank when the transport is HTTP. Something like:
   ```python
   if transport == "http" and not os.getenv("MCP_API_KEY"):
       raise SystemExit(
           "ERROR: MCP_API_KEY must be set before starting the HTTP server. "
           "Unset key allows unauthenticated access to all Google Maps API calls."
       )
   ```
2. Update `.env.example` — change `MCP_API_KEY=` to a comment that makes the requirement explicit: `# Required for HTTP transport. Generate with: python -c "import secrets; print(secrets.token_hex(32))"`
3. Add a one-line warning to the README before the ngrok step: "Before running ngrok, set `MCP_API_KEY` in your `.env`. Without it, anyone with the URL can make unlimited Google Maps API calls billed to your account."

A token-bucket rate limiter (e.g., `slowapi`, which is already compatible with Starlette/FastAPI-style apps) would add another layer, but the auth fix is the critical path.

---

The second issue is in `src/google_maps_mcp/client.py` at line 130:

```python
url = f"https://places.googleapis.com/v1/places/{place_id}"
```

`place_id` comes from the MCP tool caller with no format validation and is interpolated verbatim into the URL path. `httpx` does not encode `/` or `?` in f-string URLs — only when using a `params=` dict. A crafted `place_id` like `":searchText?textQuery=attacker-query"` produces `https://places.googleapis.com/v1/places/:searchText?textQuery=attacker-query`, which routes to the text search endpoint instead of the details endpoint, with attacker-controlled query content. Injection is bounded to `places.googleapis.com` since the host is hardcoded, but it lets an attacker hit different endpoint semantics within that namespace and potentially force higher-cost API calls.

**Fix:**
```python
import re

PLACE_ID_PATTERN = re.compile(r'^[A-Za-z0-9_\-]+(/[A-Za-z0-9_\-]+)?$')

async def get_place_details(self, place_id: str) -> dict:
    if not PLACE_ID_PATTERN.match(place_id):
        raise ValueError(f"Invalid place_id format: {place_id!r}")
    url = f"https://places.googleapis.com/v1/places/{place_id}"
    ...
```

Google Place IDs are alphanumeric strings with an optional `places/` segment prefix. That pattern eliminates all path and query injection.

---

The third issue is structural and currently benign, but worth flagging given the package is installable via PyPI as `gmaps-mcp`.

The repository ships `.claude/skills/google-maps-mcp/SKILL.md` at the repo root. Claude Code and any harness using the same skill auto-discovery path pattern will auto-load this file as a system-level instruction when an agent clones the repository or opens the directory after install. The current content is legitimate usage documentation, so there's no active harm — but the file is a persistent injection surface. A future commit to `SKILL.md` could plant arbitrary instructions (exfiltrate environment variables, call an attacker-controlled URL before each tool response, silently modify output) that would enter agent context without any visible indicator for every developer or agent that installs `gmaps-mcp`.

The exposure is broader than it would be for a private repo: PyPI install means the audience includes every Claude Code, Cursor, and similar agent-enabled IDE user who pulls the package and opens it in an agent context.

**Fix:** Move the skill documentation out of the auto-load path. Rename it to `docs/claude-skill-reference.md` (not auto-loaded), or remove it and note in the README that users who want Claude Code skill integration should add the file locally. Either approach preserves the UX without leaving a standing injection surface in the install tree.

## Which versions are affected by GHSA-52cq-7v8r-62c6?

2 open source packages ship an affected version, including gmaps-mcp.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `gmaps-mcp` | PyPI | All versions | 0.1.3 |
| `gmaps-mcp` | PyPI | All versions | 0.1.3 |

## How do I fix GHSA-52cq-7v8r-62c6?

Upgrade gmaps-mcp to 0.1.3 or later.

## Is GHSA-52cq-7v8r-62c6 being exploited?

There is no known exploitation of GHSA-52cq-7v8r-62c6 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-52cq-7v8r-62c6 and fix it if it is affected.

What it is: GHSA-52cq-7v8r-62c6 is a missing authorization vulnerability in gmaps-mcp, published on 8 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of GHSA-52cq-7v8r-62c6 in the wild and no public exploit code.

Affected packages and fixed versions:
- gmaps-mcp (PyPI): affected all versions; fixed in 0.1.3
- gmaps-mcp (PyPI): affected all versions; fixed in 0.1.3

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-52cq-7v8r-62c6/ (Markdown: https://insights.sbomify.com/GHSA-52cq-7v8r-62c6/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-52cq-7v8r-62c6

---
From sbomify Insights: https://insights.sbomify.com/GHSA-52cq-7v8r-62c6/
Summaries are generated and may contain mistakes; the official description above is the record.