GCVE-110-VULN-PYPI-2026-000612

aimarket-mcp 0.6.1 limits a server with no AIMARKET_MCP_KEY to the machine's own user: server._auth_ok requires a loopback peer, a loopback Host, no cross-site Origin and no forwarding header. A reverse proxy on the same host passes all four. nginx's default proxy_pass connects from 127.0.0.1, sends the upstream's own Host (127.0.0.1:port) and adds no forwarding header, so every caller of a keyless server behind it is treated as local and can call its tools, including web_fetch and market_invoke, which spends the operator's AIMARKET_API_KEY balance. The maintainer reproduced this through nginx against 0.6.2 (HTTP 200). Affects 0.6.1 and 0.6.2; 0.6.0 and earlier answered every caller (GCVE-110-PYPI-2026-018883). Fixed in 0.6.3, which on Linux also requires the caller's socket to belong to the user the server runs as, read from /proc/net/tcp. A proxy that runs as that same user, and any proxy on macOS or Windows, still looks local, so set AIMARKET_MCP_KEY behind any reverse proxy.