EUVD-2026-67028
GHSA-wm9h-qwfm-wf3g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
DNS rebinding requires simultaneous server operation and victim page visit (AC:H, UI:R); no server authentication needed (PR:N); full GitHub MCP session access yields C:H/I:H with no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, making the locally reachable GitHub MCP endpoint drivable from a page in a visitor's browser that pointed a name it controlled at the bound address. The fix passes the option explicitly alongside a dependency update; the update alone would not have closed it. The repository has published no release that brackets the fix, so the affected boundary is the commit preceding it.
AnalysisAI
DNS rebinding in Timescale's tiger-gh-mcp-server allows an attacker-controlled web page to drive the victim's locally-bound GitHub MCP HTTP endpoint by exploiting the server's failure to validate Host headers. The src/httpServer.ts file called the shared httpServerFactory helper without passing the SDK's host allow-list option, meaning the server accepted any Host value - a prerequisite for classic DNS rebinding. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to be running tiger-gh-mcp-server in HTTP transport mode - the stdio transport is not affected because it does not bind a network socket. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.6 with vector AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N appropriately captures the threat model: network-reachable via the browser (AV:N), low general complexity (AC:L), but dependent on a specific attack condition - DNS rebinding timing (AT:P) - and requiring the victim to visit the malicious page (UI:P). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a domain and serves a malicious JavaScript page that first resolves the domain normally, then leverages DNS rebinding to re-resolve it to 127.0.0.1. When a developer who is actively running tiger-gh-mcp-server in HTTP mode visits this page, the browser issues fetch requests to the attacker's domain - now pointing at the local MCP server - with the Host header accepted unconditionally by the unpatched server. … |
| Remediation | The definitive fix is to update to a commit at or after the merge of PR #36 (https://github.com/timescale/tiger-gh-mcp-server/pull/36), which explicitly passes the SDK host allow-list option to httpServerFactory; the dependency update included in that PR is a necessary companion but insufficient on its own. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all developers running tiger-gh-mcp-server and mandate switching to HTTPS mode with Host header validation; require localhost-only binding if HTTP mode is necessary and restrict external network access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today