Cross-origin environment variable leakage in the MCP reference server server-everything

The MCP reference server package @modelcontextprotocol/server-everything has a cross-origin environment variable leakage vulnerability: any webpage opened in the developer's browser can, without interaction, steal all API keys and credentials in the process environment. Its SSE and StreamableHTTP transports bind to 0.0.0.0, use wildcard CORS, and have no authentication; the get-env tool returns the entire process.env as-is. A proof of concept dated 2026-03-17 verified that a single tools/call returned 47 environment variables. The default stdio transport is not affected. Earlier versions, although they do not send permissive CORS headers, remain exposed to DNS rebinding risk.