CVE-2026-100868

Executive Summary

CVE-2026-100868 is an improper binding-to-interface vulnerability (CWE-1327) in Penpot, the open-source design and prototyping tool, affecting all versions before 2.18.0. In single-user mode, the MCP (Model Context Protocol) server plugin's WebSocket bridge binds to all network interfaces without authentication, allowing unauthenticated attackers on adjacent networks to connect to the WebSocket port and impersonate the Penpot browser plugin. Successful exploitation permits the attacker to intercept task payloads and return forged results to the MCP client, enabling both confidentiality loss and integrity manipulation of automated design/development workflows with a CVSS base score of 6.3.

Technical Analysis

The vulnerability resides in the MCP server plugin component of Penpot, specifically its WebSocket bridge. Penpot integrates with AI/automation clients via the Model Context Protocol (MCP), which allows an MCP client to send tasks to a browser-side or server-side plugin for execution. Under normal, secure operation, this bridge should be bound to the loopback interface (127.0.0.1) and/or protected by an authentication mechanism so that only a trusted local plugin can interact with it.

CVE-2026-100868 describes two compounding weaknesses:

1. Improper Network Binding (CWE-1327): When Penpot runs in single-user mode, the MCP server plugin WebSocket bridge does not restrict its listen socket to loopback. It binds to 0.0.0.0 (all interfaces), exposing the WebSocket endpoint to every host reachable on the same network segment, VLAN, or Wi-Fi network.

2. Missing Authentication: There is no authentication or authorization check on the WebSocket handshake or subsequent message exchange. Any client that can reach the port can open a WebSocket connection and begin speaking the bridge protocol.

Because the bridge protocol is designed to accept a "browser plugin" identity from a connected client, an unauthenticated remote party can present itself as that plugin. This creates a trust-confusion condition: the MCP client (the automation controller) believes it is communicating with the legitimate Penpot browser plugin, while in reality the connection is terminated by an attacker.

The CVSS vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L reflects:

• AV:A (Adjacent): The attacker must be on the same network segment, not remotely routable across the internet.
• AC:L (Low): No special conditions; the attacker merely needs to connect to the port.
• PR:N (None): No credentials or prior access required.
• UI:N (None): No victim interaction is needed.
• S:U (Unchanged): Impact is scoped to the vulnerable component and its connected client.
• C:L / I:L / A:L (Low): Partial confidentiality, integrity, and availability impact — the attacker can read intercepted task payloads, inject forged results, and through forged results potentially disrupt the automated workflow. It is not a full system compromise.

Notably, the interaction model means the vulnerability's blast radius extends beyond the Penpot host: the MCP client consuming the forged results is also affected, since it will act on attacker-controlled output.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available for this CVE. The attack chain below is inferred strictly from the vulnerability class and the NVD description.

1. Reconnaissance / Target Identification. An attacker with a foothold on an adjacent network segment (e.g., shared corporate Wi-Fi, a flat lab network, or a co-located container network) scans for hosts exposing the Penpot MCP WebSocket bridge port. Discovery can be performed through port scanning of common WebSocket ranges and by completing a WebSocket handshake to candidate endpoints. Because the bridge binds to all interfaces, it is directly reachable without any pivot.

2. Triggering the Flaw Class (Unauthenticated Bind). The attacker establishes a WebSocket connection to the exposed bridge. Since the service performs no authentication on connection, the handshake succeeds. The attacker then registers/identifies as the Penpot browser plugin, exploiting the absence of any identity verification to assume the plugin's role in the task exchange.

3. Payload / Execution Method. Operating as the impersonated plugin, the attacker:

   • Intercepts task payloads sent from the MCP client to the plugin, gaining access to design task data and any sensitive content contained in those messages (confidentiality impact).
   • Returns forged results back to the MCP client, substituting attacker-controlled output for genuine plugin responses (integrity impact). The exact message schema is not described in the NVD entry, so no specific field or frame-format details can be provided.

4. Post-Exploitation Impact. The MCP client acts on forged results, potentially causing incorrect automated actions, subverted design/development outputs, or disruption of the automation pipeline (availability impact). Depending on what the MCP client is authorized to do downstream, forged results could influence subsequent automated steps; however, the description does not establish code execution or privilege escalation, and no such claim should be made.

Impact Assessment

The vulnerability affects Penpot deployments before version 2.18.0 that run in single-user mode and have the MCP server plugin enabled. The primary exposure is to adjacent-network attackers — the AV:A metric means exploitation requires network adjacency rather than internet reachability, which somewhat narrows the population of exposed hosts but makes shared-network environments (co-working spaces, flat enterprise VLANs, container hosts, developer laptops on public Wi-Fi) realistic attack surfaces.

Business impact:

• Confidentiality (C:L): Task payloads transiting the MCP bridge may contain proprietary design data, internal asset references, or context passed from the automation client. Interception exposes that content to the adjacent attacker.
• Integrity (I:L): Forged results let the attacker control the output delivered to the MCP client, undermining the trustworthiness of any automated workflow that relies on the bridge. This is a supply-chain-style risk for teams that use Penpot MCP automation to drive downstream code or asset generation.
• Availability (A:L): By occupying or manipulating the bridge, the attacker can disrupt normal plugin-to-client communication, degrading or halting the automated workflow.

Blast radius includes both the Penpot host (whose bridge is being hijacked) and the MCP client host (which consumes the forged data). Because no public exploit exists and no KEV listing is present, there is no evidence of active exploitation in the wild at the time of writing. The EPSS score is not yet published by FIRST.org and must not be assumed.

Detection Guidance

Sigma Rule

title: Potential Penpot MCP WebSocket Bridge Access from Non-Loopback Source
id: c0a7f1e2-9b3d-4c5e-8a1f-2d6e7f8a9b0c
status: experimental
description: Detects inbound network connections to the Penpot MCP server plugin WebSocket bridge from a source other than loopback, which may indicate exploitation of CVE-2026-100868 (unauthenticated bind to all interfaces in single-user mode).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100868
author: threat-intel
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026-100868
logsource:
  category: network_connection
  product: windows
detection:
  selection_process:
    Image|endswith:
      - '\node'
      - '\penpot'
      - '\penpot-desktop'
  selection_direction:
    Initiated: 'false'
  selection_src:
    SourceIp|not_in:
      - '127.0.0.1'
      - '::1'
  condition: selection_process and selection_direction and selection_src
falsepositives:
  - Legitimate remote management of a shared Penpot instance with authentication enabled
  - Container-to-container traffic in a trusted orchestration network
level: medium

YARA Rule

rule CVE_2026_100868_Penpot_MCP_Bridge_Binding
{
    meta:
        description = "Detects Penpot MCP server plugin configuration or source artifacts that bind the WebSocket bridge to all interfaces (0.0.0.0) without authentication, associated with CVE-2026-100868"
        author = "threat-intel"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100868"
        cve = "CVE-2026-100868"

    strings:
        $mcp         = "MCP" ascii nocase
        $penpot      = "penpot" ascii nocase
        $bridge      = "WebSocket" ascii nocase
        $bind_all1   = "0.0.0.0" ascii
        $bind_all2   = "host: \"0.0.0.0\"" ascii
        $bind_all3   = "HOST=0.0.0.0" ascii
        $single      = "single-user" ascii nocase

    condition:
        filesize < 2MB and
        $penpot and $bridge and
        ($bind_all1 or $bind_all2 or $bind_all3) and
        ($mcp or $single)
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET any (msg:"CVE-2026-100868 Penpot MCP WebSocket Bridge Access from Adjacent Host"; flow:to_server,established; content:"|47 45 54|"; http_header; content:"Upgrade"; http_header; content:"websocket"; http_header; nocase; content:"penpot"; http_header; nocase; threshold:type limit, track by_src, count 5, seconds 60; reference:cve,2026-100868; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-100868; classtype:attempted-recon; sid:2026100868; rev:1;)

Elastic Detection

network where destination.port != 443 and
  network.transport == "tcp" and
  process.name in ("node", "penpot", "penpot-desktop") and
  source.ip != "127.0.0.1" and source.ip != "::1" and
  network.direction == "inbound"

Splunk SPL Query

index=network sourcetype=stream:tcp OR sourcetype=firewall
| search websocket_upgrade=true OR (http_header="*Upgrade: websocket*")
| search (dest_port=* AND process="*penpot*") OR app="penpot" OR uri="*penpot*"
| where src_ip!="127.0.0.1" AND src_ip!="::1"
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as attackers by dest_ip, dest_port
| where count > 1
| eval cve="CVE-2026-100868"
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="penpot,cve-2026-100868,">
  <rule id="202610868" level="10">
    <decoded_as>json</decoded_as>
    <field name="event_category">network</field>
    <field name="destination.port">\.+</field>
    <field name="network.direction">inbound</field>
    <field name="source.ip" negate="yes">127\.0\.0\.1</field>
    <field name="process.name">penpot|node|penpot-desktop</field>
    <description>CVE-2026-100868: Possible Penpot MCP WebSocket bridge access from non-loopback adjacent host</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,attempted_recon,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Restrict network exposure of the MCP WebSocket bridge port using host-based or network firewalls. Only allow loopback access (or explicitly trusted management hosts) to the bridge port.
   • If the MCP plugin is not required, disable it entirely to remove the attack surface.
   • Segment single-user Penpot workstations away from untrusted adjacent networks (avoid placing them on flat/shared VLANs, public Wi-Fi, or untrusted container networks).
   • Where possible, bind the service to 127.0.0.1 via configuration or a local reverse proxy that enforces authentication and loopback-only binding.

2. Patch / Upgrade Steps:

   • The NVD description states the issue is fixed in Penpot 2.18.0 and later. Upgrade to 2.18.0 or a newer release when available and verified. Because no vendor patch source is currently tracked (patch confidence 0/4), validate the fix against the vendor's official release notes and confirm the bridge now restricts binding and enforces authentication before relying on it.

3. Long-Term Hardening:

   • Enforce authentication and origin verification on all local automation/plugin bridges (MCP or otherwise); default to loopback binding.
   • Add network egress/ingress monitoring for unexpected bindings to 0.0.0.0.
   • Include local development bridges in vulnerability management baselines, as they are frequently overlooked compared with internet-facing services.
   • Treat MCP clients as trust boundaries: validate plugin responses server-side where feasible so forged results cannot silently propagate.

References

• NVD — CVE-2026-100868: https://nvd.nist.gov/vuln/detail/CVE-2026-100868
• CWE-1327 — Binding to an Unrestricted IP Address: https://cwe.mitre.org/data/definitions/1327.html
• Penpot official project/release information: https://penpot.app
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities catalog (status check — not listed as of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or in-the-wild exploitation evidence for CVE-2026-100868 were identified in the provided data; EPSS has not yet scored this CVE and no public PoC is known.