CVE-2026-48989 - Windows-MCP: HTTP transports expose unauthenticated PowerShell control with wildcard CORS
CVE ID :CVE-2026-48989 Published : June 17, 2026, 9:02 p.m. | 6 hours, 6 minutes ago Description :Windows-MCP is an open-source project that integrates AI agents with Windows. In versions prior to 0.7.5, certain HTTP modes exposed the MCP control plane without authentication while enabling...