CVE-2026-105806: Payload: Improper access control for MCP API keys

The plugin stores MCP API keys in a payload-mcp-api-keys collection. Each key maps to a user, and an MCP request using that key runs as that user. Before the fix, access control on that collection did not tie keys to their owner. A logged-in user with low privileges could create, read, update or delete keys outside their own account.

The practical attack is account takeover. An attacker who can get a key that resolves to a more privileged user, or can assign ownership of a key to themselves or another account, can call the MCP endpoint as that user. They then reach whatever MCP tools the instance exposes: content, globals, jobs and resources. The CVSS 4.0 vector reflects network access, low privileges, no user interaction, and high confidentiality and integrity impact.

The attacker needs a valid login on the Payload instance. Applications that do not use @payloadcms/plugin-mcp are not affected.

@payloadcms/plugin-mcp from 3.61.0 up to, but not including, 3.88.0. Only projects that enabled the MCP plugin are exposed. Check the installed version:

npm ls @payloadcms/plugin-mcp

Upgrade to @payloadcms/plugin-mcp 3.88.0 or later:

npm install @payloadcms/[email protected]

The fix commit makes create available to any signed-in user from the configured user collection. read, update, delete and unlock are limited to keys whose user matches the requester. The user field can no longer be set or changed by clients and defaults to the signed-in user. Existing keys keep working.

Until you can upgrade, the advisory says to disable the MCP plugin or restrict MCP API-key management to trusted users. After upgrading, consider rotating keys that untrusted users could reach.

Audit the payload-mcp-api-keys collection for keys you did not expect, keys created or changed by low-privilege users, and keys whose user value differs from the creator. Check API access logs for requests to the MCP endpoint made with those keys and for actions taken by the users they map to. The sources give no specific log line. Beam logs agent MCP tool calls, which helps if your own agents use this Payload MCP endpoint.

Impact

Under certain conditions, an authenticated user could manage MCP API keys outside their intended account allowing an attacker to escalate privileges through account takeover.

Applications that do not use @payloadcms/plugin-mcp are not affected.

Patches

Users should upgrade to @payloadcms/plugin-mcp version 3.88.0 or later.

Workarounds

Upgrading is recommended. Until then, disable the MCP plugin or restrict MCP API-key management to trusted users.