GCVE-110-VULN-PYPI-2026-000640

If you run the aimarket-mcp HTTP server without AIMARKET_MCP_KEY behind a reverse proxy, tunnel or port forward on the same host, and that proxy runs as the same user as the server or the host is not Linux, every caller of the proxy can use the server's tools, including web_fetch and market_invoke, which spends your AIMARKET_API_KEY balance. A keyless server answers only callers it judges local (server._auth_ok). The test added in 0.6.3 (server._caller_is_this_user) tells a proxy from a local client only by the owner of its socket in /proc/net/tcp: a proxy running as the server's user, for example nginx and the server both running as root in one container or pod, passes it, and where /proc/net/tcp does not exist (macOS, Windows) every caller passes it. Earlier versions are exposed to the same proxy as well (GCVE-110-PYPI-2026-018883, GCVE-110-VULN-PYPI-2026-000612). No release refuses such a proxy without a key. Affects 0.1.0 through 0.6.3.