EUVD-2026-83168
GHSA-5gm3-9crp-6g3v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
DNS-rebinding timing makes AC:H; victim must visit a malicious page (UI:R); browser-to-loopback app crosses scope (S:C); control tools give process control (I:H/A:H) with log read (C:L).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listener in src/mcp/server.go accepts browser-origin requests to /sse and the returned message endpoint without validating the Host header, validating the Origin header, or authenticating the caller. When MCP SSE is enabled, a malicious website can use DNS rebinding to reach the loopback listener and issue MCP requests. If expose_control_tools is enabled, the attacker can enumerate process state, read or search logs, truncate logs, and start, stop, restart, or scale local processes; configured user-defined tools can expose additional commands and output. The Gin REST API token middleware does not protect this separately started MCP listener. This issue is fixed in version 1.120.0.
AnalysisAI
Process Compose before 1.120.0 exposes its MCP SSE listener on loopback without validating the Host or Origin header or authenticating the caller, allowing a malicious website to reach that listener through DNS rebinding and issue MCP requests. Unauthenticated remote attackers (CVSS 4.0 PR:N, UI:P) can, when expose_control_tools is enabled, enumerate process state, read, search or truncate logs, and start, stop, restart or scale local processes; user-defined tools may expose further commands and output. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the victim to run process-compose (<1.120.0) with the MCP server enabled and using the SSE transport (SSE is the default MCP transport when mcp_server.transport is omitted), listening on loopback, with NO API token configured. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but conditional risk, not a drop-everything emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor fix by upgrading to Process Compose 1.120.0 (release https://github.com/F1bonacc1/process-compose/releases/tag/v1.120.0, fix commit 6ffa74f462cd2fa4f8dc1ee63c70b793b298c858), which adds the Host/Origin/token trust boundary to the MCP SSE listener; consult GHSA-5gm3-9crp-6g3v for details and note the new mcp_server.trusted_hosts schema field if non-loopback MCP clients must be accepted (clients that are not listed will be rejected with 403). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there
Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by
Casdoor through 4.4.0 exposes its instance-wide built-in JWT signing private key unmasked through the /api/get-certs and
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import pa
Path traversal in the uniget CLI (Go module gitlab.com/uniget-org/cli) before version 0.27.6 lets a local user read and
The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allow
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) c
Concurrent SAML or OpenID Connect login attempts against SUSE NeuVector can cause one user to be issued another user's f
Go through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection. Rated high severity (CVS
Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command executi
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today