CWE-306

Named by 2 kept items in this workspace.

Search every workspace for CWE-306. It matches the name as written, so it can find other things that share it.

The items that name it 2

AutoJack: How a single page can RCE the host running your AI agent | Microsoft Security Blog
writeup2026-06-19It is written here as CWE-306 - Missing Authentication for Critical Function.
AuthMiddleware in AutoGen Studio skips /api/mcp/* and /api/ws/* paths assuming they self-authenticate, but the MCP WebSocket handler never implemented that check, allowing unauthenticated connections
CVE-2026-49257: CWE-306: Missing Authentication for Critical Function in startreedata mcp-pinot - Live Threat Intelligence - Threat Radar | OffSeq.com
advisory2026-06-18It is written here as CWE-306: Missing Authentication for Critical Function.
mcp-pinot defaults to running an HTTP MCP server bound to 0.0.0.0:8080 with no authentication enabled, exposing all MCP tools (SQL query execution, schema creation, table-config mutation) to any network-adjacent caller; the server proxies calls using server-side Pinot credentials, producing a confus

All techniques in this workspace.