EUVD-2026-67027
GHSA-p943-9hp2-h27q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
DNS rebinding success depends on browser and resolver behavior outside attacker control (AC:H); victim must visit the malicious page (UI:R); no availability impact applies.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
tiger-slack started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. mcp/src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, and a page in a browser could point a name it controlled at the address the server was bound to and drive the locally reachable Slack MCP server through the visitor's browser. The fix passes the option explicitly alongside a dependency update; the update alone would not have closed it. The repository publishes no release that brackets the fix, so the affected boundary is the commit preceding it.
AnalysisAI
DNS rebinding in tiger-slack's MCP HTTP transport exposes the locally running Slack MCP server to attacker-controlled browser requests. The root cause is that mcp/src/httpServer.ts invoked httpServerFactory without enabling the SDK's host allow-list option, leaving the server willing to honor any Host header value and making it trivially reachable via a DNS rebinding attack. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim must be running tiger-slack with its MCP HTTP transport active on their local machine, and must visit a web page controlled by the attacker. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.6 reflects a meaningful but not trivial-to-execute attack. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a domain with a very short DNS TTL and hosts a malicious page; when the victim (a developer running tiger-slack) visits the page, the attacker flips the domain's DNS record to 127.0.0.1. The victim's browser subsequently sends cross-origin fetch requests carrying the attacker's domain as the Host header to the locally running tiger-slack MCP HTTP server, which accepts them without host validation. … |
| Remediation | Upstream fix available via PR #146 (https://github.com/timescale/tiger-slack/pull/146); no released patched version has been independently confirmed, as the repository publishes no tagged release that brackets the fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and disable all tiger-slack deployments in your environment until a patch is available. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today