CVE-2026-81095
pg-aiguide started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named. A page in a browser could therefore point a name it controlled at the address the server was bound to and drive the locally reachable MCP server through the visitor's browser. The protection was already available in the packaged transport and simply not turned on, so updating the dependency alone would not have closed it. Version 0.5.1 passes the option explicitly.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.6
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.16%
- CWE
- CWE-346
- Published
- 2026-08-27
- Last modified
- 2026-08-29
Affected products
- timescale pg-aiguide
Weakness type
Related vulnerabilities
- CVE-2026-87563 — Origin validation error in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker...
- CVE-2026-58649 — .NET Information Disclosure Vulnerability
- CVE-2026-69559 — Microsoft Teams for Android Information Disclosure Vulnerability
- CVE-2026-69680 — Windows DNS Spoofing Vulnerability
- CVE-2026-75156 — Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
- CVE-2026-85152 — undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors
- CVE-2026-84482 — WWBN AVideo Cross-Site Request Forgery via get_domain() validation
- CVE-2026-82811 — Toggl OÜ Toggl Track Extension postMessage origin validation