Skip to main content

MCP Ruby SDK CVE-2026-63118

| EUVDEUVD-2026-50489 MEDIUM
Origin Validation Error (CWE-346)
2026-07-29 GitHub_M GHSA-rjr6-rcgv-9m7m
Information Disclosure Ruby Sdk
6.9
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.1 MEDIUM

DNS rebinding requires attack prerequisites and mandatory browser interaction, mapping to AC:H and UI:R; scope changes to local MCP server; only confidentiality impact is confirmed.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

3
Patch available
Jul 29, 2026 - 20:02 EUVD
Source Code Evidence Fetched
Jul 29, 2026 - 20:00 vuln.today
Analysis Generated
Jul 29, 2026 - 20:00 vuln.today

DescriptionCVE.org

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not validate the HTTP Host or Origin request headers, which allows a malicious browser page to use DNS rebinding to reach a locally running MCP server and invoke exposed tools. This issue is fixed in version 0.23.0.

AnalysisAI

DNS rebinding in MCP Ruby SDK's StreamableHTTPTransport (mcp gem, all versions prior to 0.23.0) exposes locally running MCP servers to browser-driven tool invocation without authentication. The transport accepted HTTP requests without validating Host or Origin headers, allowing a malicious webpage to exploit short-TTL DNS re-resolution to reach the victim's loopback-bound server and call any registered MCP tool. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Register DNS rebinding domain with short TTL
Delivery
Lure victim developer to malicious page
Exploit
Browser re-resolves domain to 127.0.0.1
Install
Send crafted requests to local MCP server
C2
Server accepts requests without Host/Origin check
Execute
Invoke exposed MCP tools via JavaScript
Impact
Exfiltrate tool responses to attacker
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires two simultaneous conditions: the victim must be running an MCP Ruby SDK server (StreamableHTTPTransport, pre-0.23.0) locally, and the victim must visit an attacker-controlled webpage in a browser capable of performing DNS rebinding. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (6.9: AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N) accurately reflects two real constraints: AT:P (attack prerequisites - a locally running MCP server must be present) and UI:A (victim must visit the attacker's page). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker registers a domain with a very short TTL, serves a malicious JavaScript payload, and waits for a developer running a local MCP Ruby SDK server to visit the page. After the browser caches the initial DNS response, the attacker flips the domain's A record to 127.0.0.1; subsequent fetch calls from the still-open page are routed to the local MCP endpoint, which - lacking Host or Origin validation - services them. …
Remediation Upgrade the mcp gem to version 0.23.0, which is the vendor-released patch confirmed at https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0 and implemented in commit ba543083a7594e7892b29464b89091816446ff7a. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Ruby Sdk

View all
CVE-2026-67431 HIGH POC
8.3 Jul 29

Session hijacking in the MCP Ruby SDK (mcp gem) before 0.23.0 lets an attacker who obtains a valid session ID issue tool
CVE-2026-67432 HIGH POC
7.5 Jul 29

Uncontrolled memory allocation in the official Model Context Protocol Ruby SDK (mcp gem) before 0.23.0 lets an unauthent
CVE-2026-63119 MEDIUM POC
6.2 Jul 29

Uncontrolled memory growth in the MCP Ruby SDK (mcp gem) prior to 0.23.0 allows any peer process communicating via stdio
CVE-2026-67430 MEDIUM POC
5.3 Jul 29

Unbounded session growth in MCP Ruby SDK's StreamableHTTPTransport allows unauthenticated remote attackers to exhaust se

Same weakness CWE-346 – Origin Validation Error

View all
CVE-2015-4495 HIGH POC
8.8
CVE-2025-34291 CRITICAL POC
9.4
CVE-2020-16952 HIGH POC
8.6
CVE-2022-50925 CRITICAL POC
9.8
CVE-2024-25124 CRITICAL POC
9.8
CVE-2023-29711 CRITICAL POC
9.8
CVE-2023-33443 CRITICAL POC
9.8
CVE-2023-29728 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-63118 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy