All vulnerabilities

CVE-2026-NONE · GHSA-2v4r-q3fw-82j7

orion-cli: unauthenticated MCP admin proxy lets DNS-rebound web pages administer Orion via disabled Host-guard

highCVSS 8.8CWE-306CWE-346CWE-1188

Vendor

GoPlasmatic

Package

orion-cli cargo

Affected

< 1.2.0

Fixed in

1.2.0 (fixed by removing the MCP server entirely)

Disclosed

2026-09-25

Credit

Avishai Gonen

dns-rebindingauth-bypassmcp

Published advisory