BSidesTLV 2026 · Main Hall

One Page to Rule Them All.

Hijacking MCP servers with DNS rebinding - from a CircleCI MCP server to RCE, Docker Hub credentials abused through the browser, and one SDK default that spread.

Talk by Avishai Gonen & Yotam Perkal · materials below

Slides

Download slides (PDF)

The demo clips are below - they don't play inside the PDF.

Demos

CircleCI - rebind to RCE

Video published once it is cut from the talk recording.

Docker Hub - credential abuse through a browser tab

Held until the vendor fix is confirmed public.

The cases

CircleCI MCP - DNS rebinding (GHSA-jwj7-74jh-p5c4, CVSS 8.3) reaches the local server, which holds the developer's token; an unquoted filename in run_evaluation_tests is unauthenticated command injection (GHSA-m9x7-h9px-p447, CVSS 10.0) - RCE in the CI runner. Fixed in 0.16.1 / 0.17.0.

Docker Hub MCP - DNS rebinding turns the server's stored Docker Hub token against its owner. Details published once the fix is confirmed.
mark3labs/mcp-go - an SDK default with no Host / Origin allowlist, inherited by downstream servers. Details published once the fix is confirmed.

Responsible disclosure

Everything shown here was reported to the vendor and fixed before publication. Sections marked pending stay dark until their fix is confirmed public - nothing on this page targets a live, unpatched system.