CVE-2026-58446

Medium

Description

Presenton before 0.8.8-beta bundles an MCP server that, on server/Docker deployments configured with session authentication (AUTH_USERNAME/AUTH_PASSWORD), is reachable unauthenticated at /mcp because the nginx front-end does not apply the auth_request gate to that path and the MCP server auto-mints a valid internal session token for the configured user. A remote unauthenticated attacker can invoke MCP tools such as generate_presentation, performing authenticated application actions, consuming the operators configured LLM API keys, and creating presentations in the operators instance. The Electron desktop build is not affected (MCP disabled).

SeverityMedium

CVSS6.5

Exploit probability—

ProductPresenton

PublishedJun 30, 2026

First seenJun 30, 2026

Weakness typeCWE-306Missing authentication for critical function

How to fix

Update

presenton presenton0.8.8-beta or later

Patches

github.com/presenton/presenton/commit/a1103dcef3c761cc8bab44e2862c81a49969abd7

Vendor advisories

github.com/presenton/presenton/releases/tag/electron-v0.8.8-beta

Affected products

Product	Affected versions	Fixed in
presenton presenton	v < 0.8.8-beta	0.8.8-beta

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.