A developer tool that binds 0.0.0.0, disables its own auth middleware when no password is set, and exposes an unauthenticated tunnel-start endpoint does not just have an exposure problem — it has a self-publishing one.
The permission system worked exactly as designed. It just had the wrong answer to the only question that mattered: is code.replace a read or a write?
An editing tool that accepts an absolute path and uses it verbatim is not a code editor with a bug. It is a file-write API that happens to be pointed at code most of the time.
When an MCP tool argument reaches filepath.Join unvalidated, the attacker does not need to touch the server at all — they only need to get one sentence into something the model reads.
CVE-2026-55529 turns one call to startswith() into a browser-mediated attack on a local MCP server: because http://localhost.evil.example begins with http://localhost, a malicious webpage can drive tools/call against an unauthenticated agent running on the victim's own machine.