All vulnerabilities

CVE-2026-NONE · GHSA-jwj7-74jh-p5c4

mcp-server-circleci: DNS rebinding allows invocation of MCP tools using the server-held PAT

highCWE-346CWE-918

Vendor

CircleCI-Public

Package

mcp-server-circleci npm

Affected

< 0.17.0

Fixed in

0.17.0

Disclosed

2026-07-22

Credit

Avishai Gonen

dns-rebindingssrfmcp

Published advisory