PT-2026-53995 · Unknown · Presentmon

George Chen · Published 2026-06-30 · Updated 2026-06-30 · CVE-2026-58446

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Presenton versions prior to 0.8.8-beta

Description In server or Docker deployments using session authentication via AUTH USERNAME and AUTH PASSWORD, the bundled MCP server is accessible without authentication at the '/mcp' endpoint. This occurs because the nginx front-end fails to apply the auth request gate to this specific path, and the MCP server automatically generates a valid internal session token for the configured user. A remote unauthenticated attacker can exploit this to invoke MCP tools, such as generate presentation(), allowing them to perform authenticated actions, consume the operator's configured LLM API keys, and create presentations within the instance.

Recommendations Update to version 0.8.8-beta or later.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-58446

Affected Products

Presentmon

References · 9

• 🔥 https://github.com/presenton/presenton/issues/678 · Exploit
• https://github.com/presenton/presenton/commit/a1103dcef3c761cc8bab44e2862c81a49969abd7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-58446 · Security Note
• https://github.com/presenton/presenton/pull/679 · Note
• https://github.com/presenton/presenton/releases/tag/electron-v0.8.8-beta · Note
• https://twitter.com/VulmonFeeds/status/2072101972077891718 · Twitter Post
• https://twitter.com/CVEnew/status/2072076782963159196 · Twitter Post
• https://vulncheck.com/advisories/presenton-beta-authentication-bypass-of-session-auth-via-unprotected-mcp-endpoint · Note
• https://twitter.com/infoflowcloud/status/2072078115480736171 · Twitter Post