All vulnerabilities

CVE-2026-NONE

ibmi-mcp-server: browser DNS rebinding can control IBM i SQL tools through server-held DB2i credentials

unknownCWE-346CWE-306

Vendor

IBM

Package

ibmi-mcp-server

Fixed in

fix in pull request #163

Credit

Avishai Gonen

dns-rebindingauth-bypassmcp

Published advisory

Bug bounty awarded. Reported through HackerOne.