CVE-2026-49357

HighCVSS 8.8/10Last modified Jun 23, 2026

Description

Line Desktop MCP is a project that, while unaffiliated with the official line-bot-mcp-server, allows users to directly operate the LINE Desktop application on Windows or Mac via MCP. `line-desktop-mcp` supports a `--http-mode` Streamable HTTP transport for use with clients such as n8n. In this mode the server binds to `0.0.0.0` and exposes the MCP `/mcp` endpoint without an MCP-layer authentication check. Prior to version 1.1.2, any network client that can reach the port can initialize a session, list tools, and call tools that read LINE Desktop chat history or send LINE messages through the already logged-in desktop application. Version 1.1.2 fixes the issue.

Metrics

CVSS 4.0 8.8/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-306CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Jun 19, 2026
Last modified
Jun 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-493583.0PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `AbstractGenerator::$temporaryFilCVE-2026-493596.5PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `pontedilana/php-weasyprint` fetcCVE-2026-49366.2IBM PowerVM Hypervisor Platform KeyStore (PKS) and virtual TPM FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 througCVE-2026-493607.8Recce is a data-validation toolkit for enhanced dbt (data build tool) PR review. Prior to version 1.50.0, OSS server deployments that exposeCVE-2026-493617.5Apache Fluss versions prior to 0.9.1 configure the Netty LengthFieldBasedFrameDecoder with Integer.MAX_VALUE as the maximum frame length, alCVE-2026-493627.5An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulatCVE-2026-493637.5An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBE_TOPOLOGY requeCVE-2026-493649.1An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial clusterCVE-2026-493655.3Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Netty HTTP component. The camel-netty-http HTTP CVE-2026-493667.8In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completionCVE-2026-493678.8In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user accountCVE-2026-493685.4In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible