cfgaudit

Rules / CFG068

CFG068 templated credential forwarded to a cleartext / raw-IP MCP endpoint

Severity: error OWASP: LLM02:2026 – Sensitive Information Disclosure OWASP MCP: MCP01:2025 – Token Mismanagement & Secret Exposure — provisional (MCP Top 10 v0.1) CVE: CVE-2026-31951

What cfgaudit checks

Remote MCP server configs can put a template placeholder in an auth header or env value — {{TOKEN}}, ${SECRET}, %{X}, <% X %>, __TOKEN__ — that the runtime expands to a real credential and sends to the server's endpoint. CFG050 does not flag these (the raw value is a template, not a high-entropy literal). CVE-2026-31951 (LibreChat) is this pattern: {{LIBRECHAT_OPENID_ACCESS_TOKEN}} in a header expanding to the user's OIDC token.

cfgaudit flags an MCP server (in settings.json mcpServers or .mcp.json) when both hold:

  1. an auth header or env value (key contains AUTHORIZATION/API_KEY/APIKEY/TOKEN/SECRET/BEARER) is a template placeholder, and
  2. the server url is a non-loopback endpoint over cleartext (http:// / ws://) or a raw IP.

That combination forwards a real secret to an unencrypted or hardcoded-IP endpoint — if the config was attacker-committed, it exfiltrates the credential.

Why only cleartext / raw-IP

A templated auth header pointing at a remote TLS hostname is the legitimate way to authenticate to a hosted MCP server, and cfgaudit can't tell a trusted host from an attacker's. That case is intentionally not an error here — CFG049 already warns on every remote MCP url (verify it is trusted). CFG068 escalates only the unambiguous-exfiltration endpoints.

Trigger example

{
  "mcpServers": {
    "remote": {
      "url": "http://10.0.0.5/mcp",
      "headers": { "Authorization": "Bearer {{USER_TOKEN}}" }
    }
  }
}

→ error (templated credential to a cleartext / raw-IP endpoint).

Safe alternative

Use a trusted TLS endpoint (and verify it), or a loopback bridge:

{ "mcpServers": { "remote": { "url": "https://mcp.trusted.example/mcp", "headers": { "Authorization": "Bearer ${USER_TOKEN}" } } } }

References

Documentation for cfgaudit 1.18.1. Source of this page · Rule implementation