44 published disclosures,
disclosed through GitHub Security Advisories. Every entry links to its
advisory and fix; technical writeups are added as each disclosure clears.
Filter by severity, year or ecosystem, or search the text.
GHSA-2v4r-q3fw-82j7
8.8high
orion-cli mcp serve --http disables the MCP SDK's default Host/Origin allowlist and adds no auth middleware of its own, while binding 0.0.0.0:8081 by default, so a DNS-rebound browser can reach the endpoint and call any of the 32 administrative tools (workflow/channel/connector CRUD, data injection, DLQ purge, engine reload) with no credential, under whatever backend admin API key the operator configured.
CWE-306CWE-346CWE-1188
CVE-2026-77339
5.1medium
The process-compose MCP surface lacks Host header validation, so any website a developer visits can reach it via DNS rebinding and drive local process control tools.
CWE-306CWE-346
CVE-2026-61568
9.6critical
The Streamable HTTP transport accepts requests without validating the Host header, letting a malicious page reach the locally-bound MCP server via DNS rebinding.
CWE-350
CVE-2026-61559
9.6critical
Unvalidated user-controlled URLs in the GitLab MCP server let an attacker make the host issue requests to arbitrary destinations, reaching internal services.
CWE-918
GHSA-fcj2-hj27-hj26
7.2high
When no fixed GitLab URL is configured, the legacy HTTP MCP handler takes the GitLab base URL from a caller-supplied GITLAB-URL header, validates only syntax (no private/loopback/link-local/metadata check), and sends GitLab discovery requests with the caller's token to that URL before the token is ever verified, letting any network client force the server to make requests to internal targets.
CWE-918
GHSA-pf89-39r3-75vq
high
The MCP SDK's Host-header validation only installs for host=127.0.0.1/localhost/::1 or an explicit allowedHosts list; the project's own Dockerfile/docker-compose.yml runs with host=0.0.0.0 and no allowedHosts, so a DNS-rebound browser can reach the endpoint and invoke deepseek_chat/deepseek_fim under the operator's API key with no credential.
CWE-346
GHSA-x42w-fxc3-j24q
5.8medium
The troth_status/troth_logs/troth_diff/troth_kill/troth_clean MCP tools pass a caller-supplied run_id directly into filesystem paths with no validation, letting a traversal payload escape the runs directory and, via a planted meta.json, delete an arbitrary attacker-chosen directory.
CWE-22
GHSA-2qr4-ww3x-mq4g
5.8medium
gomodel documents a DNS-rebinding defense (http.CrossOriginProtection with no trusted-origin configured), but its fallback check only compares Origin's hostname to Host's hostname, which a real DNS rebind always satisfies, letting an unauthenticated rebound caller reach the MCP gateway and its aggregated tools under the project's own documented Quick Start.
CWE-350
GHSA-89h6-rm4x-9rw7
8.8high
mcp-gateway's /mcp transport has no Host/Origin validation and ships with auth disabled by default, so a DNS-rebound browser is granted an anonymous admin identity and can invoke any of the 16 gateway-management tools, including gateway_invoke against any configured backend.
CWE-346
GHSA-m78m-g6g8-4455
7.1high
The order-entry tools accept a caller-supplied confirm flag that satisfies the confirmation gate on its own, so any MCP client, or a prompt-injected LLM, can place, amend or cancel brokerage orders without a human ever approving them.
CWE-862
CVE-2026-81735
10.0critical
The bundled @agent-infra MCP servers listen on all interfaces with no authentication, exposing arbitrary command execution to anyone who can reach the host.
CWE-306
CVE-2026-81102
2.3low
The MCP server omits Host header validation, so a browser-based DNS rebinding attack can reach the locally-bound service.
CWE-346
CVE-2026-81101
6.9medium
The CLI sends stored credentials to whatever endpoint is configured, without validating it - so a crafted configuration exfiltrates the user's API token.
CWE-200
CVE-2026-81100
7.6medium
With the Host header allow-list disabled, a malicious web page can reach the locally-bound tiger-gh-mcp-server through DNS rebinding.
CWE-346
CVE-2026-81099
7.6medium
With the Host header allow-list disabled, a malicious web page can reach the locally-bound tiger-slack MCP server through DNS rebinding.
CWE-346
CVE-2026-81098
9.3critical
The Streamable HTTP transport exposes its endpoints with no authentication, so anyone able to reach the port can invoke the server's tools.
CWE-306
CVE-2026-81097
8.6high
The execute_ruby tool's PTY handling can be escaped, letting an attacker run arbitrary operating-system commands on the host.
CWE-78
CVE-2026-81096
9.3critical
The python_code_executor tool can be escaped, and the service is reachable without authentication - together yielding remote code execution.
CWE-94
CVE-2026-81095
7.6medium
The Host header allow-list is disabled by configuration in pg-aiguide, so a browser-based DNS rebinding attack can reach the local MCP server.
CWE-346
CVE-2026-81092
7.6medium
mcp-go's HTTP transports do not validate the Host header before 0.56.0, allowing a malicious web page to reach a locally-bound server through DNS rebinding.
CWE-346
GHSA-v8jh-gv7v-3gvq
8.8high
ssh-mcp's command classifier never inspects the contents of $(...) or backtick substitution, so a command like echo $(sudo useradd ...) classifies as 'safe' instead of 'privileged', skipping the human-approval gate and letting a safe-only role run root commands on production SSH targets.
CWE-863
GHSA-qqh2-7466-82f8
4.9medium
subscribe_feed's internal-host guard string-matches literals and misses IPv4-mapped IPv6 notation (::ffff:127.0.0.1), while import_opml never calls the guard at all, letting an RSS article or crafted OPML document make FreshRSS fetch loopback services or the cloud metadata endpoint server-side.
CWE-918
CVE-2026-55637
8.8high
The GenieACS MCP Streamable HTTP transport does not validate the Host header, so a malicious web page can reach the locally-bound service through DNS rebinding.
CWE-346
GHSA-9cvx-7x8q-3g6m
6.0medium
Prism's bundled dashboard auto-starts on loopback with auth disabled by default and validates neither Host nor Origin, so a DNS-rebound browser can read and export a developer's full cross-project AI-coding session memory (decisions, TODOs, summaries) with zero credentials.
CWE-346
CVE-2026-86045
10.0critical
The setup endpoint answers without authentication, so anyone who can reach the host can redirect the AI backend's traffic.
CWE-15CWE-306
CVE-2026-107824
10.0critical
The x64dbg-MCP Server plugin exposes the full x64dbg debugging API (71 tools) over HTTP/SSE with no authentication and binds 0.0.0.0 by default, letting any network peer execute arbitrary x64dbg commands, attach to processes by PID, and read/write arbitrary memory, out of the box.
CWE-306
GHSA-4pvf-9j6w-8m88
critical
Testkube's MCP server in Streamable HTTP mode builds its transport with no inbound auth middleware, so any network client can complete the handshake and call any of the 32 registered tools, including run_workflow, create_workflow, and abort_workflow_execution, using the server's own outbound TK_ACCESS_TOKEN; the Docker image also silently escalates the bind host to 0.0.0.0 when this transport is enabled.
CWE-306
GHSA-r9cw-h8gp-g9hf
medium
yutu's CLI enforces a real confirmation prompt (or --yes flag) before destructive operations, but all 15 destructive MCP tool handlers wire directly to the same delete functions and skip that gate entirely, letting any MCP caller delete videos, comments, playlists, subscriptions, and other resources with no human-facing confirmation.
CWE-862
CVE-2026-92149
8.3high
The yutu MCP HTTP transport requires no authentication, so anyone who can reach the port can act on the operator's YouTube account: deleting videos, playlists and comments.
GHSA-9mpj-6v9h-42pj
high
hermes_approve requires only a bare approvalId the calling MCP client already received from its own prior hermes_prepare call, with no out-of-band or human-facing check, so any MCP client can prepare and approve an action in the same session and dispatch a real side effect (message, payment, git push, credential change) with no human ever reviewing it.
CWE-862
GHSA-hhq4-w9j2-38hg
low
assertPublicHttpUrl validates a hostname's resolved DNS addresses against a private/loopback/link-local blocklist but discards those addresses; fetch() and Chromium navigation then re-resolve the hostname independently, so an attacker controlling DNS can answer the validation lookup with a public IP and the connect-time lookup with a private/loopback address moments later, defeating the SSRF guard for links.broken, html.url, and screenshot.capture.
CWE-918
CVE-2026-95856
10.0critical
The promptFiles[].fileName parameter of run_evaluation_tests is interpolated unquoted into shell commands submitted to the CircleCI API; in the documented shared-token remote deployment mode this requires no authentication, letting an unauthenticated caller run arbitrary shell under the server's CircleCI token.
CWE-78
CVE-2026-95855
high
The local MCP server did not validate Host/Origin headers, so a DNS-rebinding attack from a malicious webpage could reach the local MCP endpoint and invoke tools such as pipeline execution, workflow reruns, and rollbacks under the victim's CircleCI Personal Access Token.
CWE-346CWE-918
CVE-2026-77359
9.3critical
Combining missing Host header validation with unauthenticated management routes, a malicious web page can rebind to the local MCP server and seize control of the Jupyter backend.
CWE-350
CVE-2026-77329
5.3medium
The Tapo MCP server validates no Host header, so a web page the user visits can reach the local server and drive smart-home controls.
CWE-346CWE-350
CVE-2026-77318
7.3high
In standalone HTTP mode the management routes require no authentication, allowing an attacker to reconfigure and take over the Jupyter backend the MCP server controls.
CWE-306
CVE-2026-55642
9.8critical
dbx-web fails open when no password is configured: authentication is skipped entirely, so an unauthenticated client can execute arbitrary SQL against connected databases.
CWE-306
CVE-2026-76807
9.3critical
With no Host header validation, any site the user visits can reach the local MCP server and read, write or delete Todoist data.
CWE-346CWE-350
CVE-2026-61742
8.3high
The DBHub HTTP transport omits Host header validation, so a browser-based DNS rebinding attack can issue unauthenticated SQL queries from outside the local network.
CWE-306CWE-346
GHSA-888h-2xjf-cgj7
high
DBX Web binds all interfaces with no password configured by default and forwards every /api request when no password hash exists, combined with a fully permissive CORS policy, so a DNS-rebound browser can reach a victim's local DBX Web instance and execute database queries and connection management calls with no credential.
CWE-306CWE-346CWE-350
CVE-2026-61546
8.8high
The local AnkiMCP HTTP tools require no authentication and do not validate the Host header, exposing them to DNS rebinding.
CWE-346CWE-350
CVE-2026-61542
7.6high
The MCP HTTP transport listens on all interfaces with no authentication, while the documentation describes it as localhost-only.
CWE-306
ibmi-mcp-server: browser DNS rebinding can control IBM i SQL tools through server-held DB2i credentials
high
ibmi-mcp-server's HTTP MCP transport installs CORS but does not reject attacker-controlled Host and Origin values before MCP dispatch, and skips auth middleware entirely when MCP_AUTH_MODE=none, so a DNS-rebound public website can become an MCP client for the IBM i schema and SQL tooling under the server's own DB2i credentials.
CWE-346CWE-306
discourse-mcp: DNS rebinding allows use of server-held Discourse API privileges
high
Discourse MCP's HTTP transport accepts unauthenticated MCP JSON-RPC requests and does not validate Host or Origin, so a DNS-rebound website can reach a victim's local MCP endpoint and call Discourse tools under the API key configured in the MCP process, gaining use of its effective Discourse privileges without ever learning the key itself.
CWE-346