ElixirLS: binding the MCP server to loopback
The opt-in MCP server listened on all interfaces with no authentication, exposing its six read-only project-inspection tools to the network.
Guilherme Silva
Trust boundaries of the BEAM runtime, measured: what a default exposes, what a control actually does, and what was not measured. Erlang/OTP and the tools built on it.
Security research
Erlang/OTP: documenting how to bind a distributed node to loopback
The documentation did not say how to confine a distributed node to the local host, what each setting does and does not do, or that binding is not authentication.
VS Code Erlang extension: finding and fixing an unauthenticated RCE
The LSP, debugger and Erlang distribution sockets listened on all interfaces, so anyone on the network could evaluate arbitrary Erlang as the developer.
Measurements
Re-runnable, in Docker, on OTP 27, 28 and 29. Each repository states what it measured, how, and what it did not.
| Repository | What it measures | Behind |
|---|---|---|
| otp-loopback-node-measurements | Where a distributed node listens. The cookie, the bind address and the node name are three different controls. 24 cases, IPv4 and IPv6. | the OTP documentation change |
| otp-dist-tls-measurements | What -proto_dist inet_tls protects. The client certificate authenticates before the cookie; verify_none falls back to cookie-only; TLS does not move the listener off 0.0.0.0. |
no write-up yet |
| elixir-ls-mcp-bind-measurements | The ElixirLS MCP listener before and after the change, and why the bundled client kept working either way. | the ElixirLS change |