Rules / CFG066

CFG066 MCP server env sets a wildcard CORS origin

Severity: warn (wildcard alone) · error (with anonymous access) OWASP: LLM03:2026 – Excessive Agency OWASP MCP: MCP07:2025 – Insufficient Authentication & Authorization — provisional (MCP Top 10 v0.1) CVE: CVE-2026-33010

What cfgaudit checks

HTTP-transport MCP servers (e.g. mcp-memory-service) read their CORS allow-origin policy from an env variable. A wildcard (*) lets any web page the user visits issue cross-origin requests to the server. If the server also allows anonymous access, any site can then read or manipulate all of the server's data — including agent memory — without authentication (CVE-2026-33010).

cfgaudit inspects every MCP server's env (in settings.json mcpServers and the project .mcp.json) for a CORS-origin key whose value contains a bare *:

CORS_ORIGINS, CORS_ALLOW_ORIGIN, ALLOWED_ORIGINS, ALLOW_ORIGINS, MCP_CORS_ORIGINS, ACCESS_CONTROL_ALLOW_ORIGIN

Severity	When
`warn`	wildcard CORS origin on its own
`error`	wildcard CORS and authentication disabled in the same env — `MCP_ALLOW_ANONYMOUS_ACCESS`/`ALLOW_ANONYMOUS`/`ANONYMOUS_ACCESS`/`AUTH_DISABLED`/`DISABLE_AUTH`/`NO_AUTH` truthy, or `REQUIRE_AUTH`/`AUTH_REQUIRED`/`AUTH_ENABLED` falsy

Trigger example

{
  "mcpServers": {
    "memory": {
      "command": "mcp-memory-service",
      "env": { "MCP_CORS_ORIGINS": "*", "MCP_ALLOW_ANONYMOUS_ACCESS": "true" }
    }
  }
}

→ error (wildcard CORS + anonymous access).

Safe alternative

Restrict the allowed origins and keep authentication on:

{ "env": { "MCP_CORS_ORIGINS": "https://app.example.com", "MCP_ALLOW_ANONYMOUS_ACCESS": "false" } }

References

CVE-2026-33010
CFG018 (MCP server binds to all interfaces) — related MCP network-exposure rule
OWASP Top 10 for MCP — MCP07 (Insufficient Authentication & Authorization)

Documentation for cfgaudit 1.18.1. Source of this page · Rule implementation