All vulnerabilities

CVE-2026-NONE · GHSA-89h6-rm4x-9rw7

mcp-gateway: DNS rebinding gives web pages unauthenticated admin control over the MCP surface

highCVSS 8.8CWE-346

Vendor

MikkoParkkola

Package

mcp-gateway npm

Affected

>= 2.12.0, <= 3.4.0

Fixed in

3.5.0

Disclosed

2026-08-28

Credit

Avishai Gonen

dns-rebindingmcphost-header

Published advisory