All vulnerabilities

CVE-2026-NONE

discourse-mcp: DNS rebinding allows use of server-held Discourse API privileges

unknownCWE-346

Vendor

discourse

Package

discourse-mcp npm

Fixed in

fixed by commit 0064a760a00ba4ca63045bb2cc660290989f5935

Credit

Avishai Gonen

dns-rebindingmcp

Published advisory

Bug bounty awarded. Reported through HackerOne.