$ whoami

Avishai Gonen

$ cat role.txt

Security enthusiast

$ cat focus.txt

I've always been curious about how systems work and what happens when they break. That's what got me into security. These days, I spend my free time solving challenges, doing bug bounty, and digging through source code to see what I can find. Every now and then, that turns into a vulnerability disclosure. Most of the time, it's just a good way to keep learning and getting better.

Vulnerability Research CTF Writeups

GitHub LinkedIn avishaigonen@gmail.com

42

CVEs published

665

CTF writeups published

$5000+

Earned in bug bounties

cat about.md

About

I work on web security: application and API bugs, authentication logic, and the request-handling code that sits in front of everything else. Lately that has meant the servers AI agents talk to, where the same old mistakes keep showing up in new places.

Most of my published work started the same way. Read how something was built, notice an assumption that does not hold, then check whether it actually matters.

I learned this through CTFs rather than coursework. Several hundred challenges across web exploitation, boot2root machines and crypto, all written up as I went.

Web & API exploitation
Bug bounty
CTF
AI & MCP tooling security
Android application security

cat experience.log

Experience

Security Researcher

Pluto Security

May 2026 - Sep 2026 · Tel Aviv District, Israel (On-site)

Disclosed 24 CVEs in open-source AI and agent infrastructure, published through vendor and GitHub Security Advisories with public credit.
Focused on Model Context Protocol servers: DNS rebinding against local transports, authentication that fails open, and sandbox escapes leading to remote code execution.
Built MCP Binder (https://github.com/plutosecurity/mcp_binder), an open-source lab for reproducing MCP DNS rebinding attacks end to end.
Hunted malicious VS Code and Open VSX extensions, building automated analysis pipelines and training AI models to identify suspicious and malicious extensions; recognized in the Open VSX Security Hall of Fame (https://researcher-recognition.open-vsx.org/hall-of-fame/).

cat education.log

Education

Bachelor of Science - BS, Computer Science

Jerusalem College of Technology

Mar 2018 - May 2024 · Israel · Grade 98

Completed the degree during high school.
Graduated on the Rector's List.

ls -la ./cves

Vulnerability Research

42 published CVEs, disclosed through GitHub Security Advisories. Each entry links to its advisory and the fixed version; technical writeups are added as each disclosure clears.

CVE-2026-NONE 8.8high

orion-cli: unauthenticated MCP admin proxy lets DNS-rebound web pages administer Orion via disabled Host-guard

orion-cli mcp serve --http disables the MCP SDK's default Host/Origin allowlist and adds no auth middleware of its own, while binding 0.0.0.0:8081 by default, so a DNS-rebound browser can reach the endpoint and call any of the 32 administrative tools (workflow/channel/connector CRUD, data injection, DLQ purge, engine reload) with no credential, under whatever backend admin API key the operator configured.

CWE-306CWE-346CWE-1188

orion-cliaffects < 1.2.02026-09-25

CVE-2026-77339 5.1medium

Process Compose: browser DNS rebinding lets websites control local MCP tools

The process-compose MCP surface lacks Host header validation, so any website a developer visits can reach it via DNS rebinding and drive local process control tools.

CWE-306CWE-346

github.com/f1bonacc1/process-composeaffects < 1.120.02026-09-18

CVE-2026-61568 9.6critical

@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport

The Streamable HTTP transport accepts requests without validating the Host header, letting a malicious page reach the locally-bound MCP server via DNS rebinding.

CWE-350

@zereight/mcp-gitlabaffects < 2.1.302026-09-15

CVE-2026-61559 9.6critical

@zereight/mcp-gitlab vulnerable to server-side request forgery

Unvalidated user-controlled URLs in the GitLab MCP server let an attacker make the host issue requests to arbitrary destinations, reaching internal services.

CWE-918

@zereight/mcp-gitlabaffects >= 0.0.1, < 2.1.272026-09-15

CVE-2026-NONE 7.2high

gitlab-mcp-server: caller-controlled GITLAB-URL enables SSRF in legacy HTTP mode

When no fixed GitLab URL is configured, the legacy HTTP MCP handler takes the GitLab base URL from a caller-supplied GITLAB-URL header, validates only syntax (no private/loopback/link-local/metadata check), and sends GitLab discovery requests with the caller's token to that URL before the token is ever verified, letting any network client force the server to make requests to internal targets.

CWE-918

github.com/jmrplens/gitlab-mcp-serveraffects >= 1.1.0, <= 2.7.5 (module path github.com/jmrplens/gitlab-mcp-server/v2; neither v1 nor v2 module path received a patch)2026-09-14

CVE-2026-NONE high

deepseek-mcp-server: DNS rebinding bypasses Host-validation guard in the shipped Docker default, exposing the DeepSeek API key

The MCP SDK's Host-header validation only installs for host=127.0.0.1/localhost/::1 or an explicit allowedHosts list; the project's own Dockerfile/docker-compose.yml runs with host=0.0.0.0 and no allowedHosts, so a DNS-rebound browser can reach the endpoint and invoke deepseek_chat/deepseek_fim under the operator's API key with no credential.

CWE-346

deepseek-mcp-serveraffects >= 1.8.0, < 2.3.02026-09-05

View all 42 CVEs

cat bounty.txt

Bug Bounty

HackerOne

@avishaigonen

Bug bounty across public and private programmes.

Profile

YesWeHack

@avishaigonen

Bug bounty across public and private programmes.

Profile

Intigriti

@avishaigonen_pluto

Bug bounty across public and private programmes.

Profile

Msrc

@Avishai Gonen

Microsoft Security Response Center (MSRC) vulnerability research. (2027)

Profile

INCD VDP

@אבישי גונן

Israeli National Cyber Directorate - Vulnerability Disclosure Program (VDP) vulnerability research.

Profile

cat publications.bib

Publications

GraphQL Injection

DigitalWhisper Magazine · DW177Magazine

Analysis of GraphQL injection vectors: how introspection and resolver mishandling create exploitable paths, the attack chains that follow, and the real-world weaknesses behind them.

Read the research (PDF)

The Notebook Backdoor: jupyter-mcp-server Vulnerabilities

Pluto Security Research2026-08-27Blog

Two CVEs in jupyter-mcp-server chain into a zero-click hijack of any live Jupyter notebook connection.

Read the writeup

Vicious Circle: Owning CircleCI's MCP Server With a Filename and a DNS Record

Pluto Security Research2026-07-29Blog

Chaining a filename and a DNS record to take over CircleCI's MCP server.

Read the writeup

ls -la ./projects

Projects

MCP Binder

JavaScript

Research framework for turning MCP DNS rebinding into a live attack lab. Scans local MCP servers from a Chrome extension, drives a real DNS rebinding attack through your own VM and DNS zone, captures the MCP session, and operates it from a token-protected dashboard.

mcpdns-rebindingresearch-tooling

GitHub

Time Side-Channel Attack

C++

Academic project implementing time side-channel attacks: password-verification timing, defeating artificial random delays with statistics, and ECDSA key extraction. Runs against ESP32 and Arduino hardware, with a written report.

side-channelcryptoembedded

GitHub

WordPress Vulnerability Lab

Python

A Docker-based lab for standing up WordPress with arbitrary plugin sets and versions, so vulnerability research can be reproduced locally against a target you control.

labdockerweb

GitHub