Monthly
Origin validation failure in Microsoft Edge (Chromium-based) enables unauthenticated remote attackers to bypass browser security features, resulting in limited cross-origin confidentiality and integrity impacts. The vulnerability (CWE-346) exploits improper validation of request origins within the Chromium-based browser engine and requires user interaction to trigger. No public exploit code has been identified at time of analysis, and Microsoft has released a patch via the MSRC update guide.
Spring Cloud Function's ServerlessHttpServletRequest.isSecure() method returns an unchecked result that does not reflect the actual HTTP transport scheme, enabling applications that gate security decisions on this call to behave incorrectly. Affected versions span three active release lines: 5.0.0-5.0.3, 4.3.0-4.3.4, and 4.2.0-4.2.7. No public exploit code exists and the vulnerability is not listed in CISA KEV; the vendor-assigned CVSS of 3.1 (Low) reflects constrained exploitation prerequisites including high privilege and user interaction.
DNS rebinding in Dropbox's mcp-server-dash (network mode) allows a malicious web page to reach the local MCP listener and invoke Dropbox API tools - company-search and file-detail - under the victim's stored Dropbox credential. The server bound to the loopback interface but performed no Host header validation, letting a browser issue cross-origin requests via a rebound domain that resolves to 127.0.0.1. No public exploit has been identified at time of analysis; CVSS 4.0 scores this at 2.3, reflecting the attack's prerequisites of user interaction and a specific deployment mode.
DNS rebinding in Timescale's tiger-gh-mcp-server allows an attacker-controlled web page to drive the victim's locally-bound GitHub MCP HTTP endpoint by exploiting the server's failure to validate Host headers. The src/httpServer.ts file called the shared httpServerFactory helper without passing the SDK's host allow-list option, meaning the server accepted any Host value - a prerequisite for classic DNS rebinding. An attacker who lures a developer running the server in HTTP mode to visit a malicious page can then invoke arbitrary GitHub MCP tools under the victim's authenticated session, including reading private repositories or issuing write operations. No public exploit has been identified and the vulnerability is not listed in CISA KEV.
DNS rebinding in tiger-slack's MCP HTTP transport exposes the locally running Slack MCP server to attacker-controlled browser requests. The root cause is that `mcp/src/httpServer.ts` invoked `httpServerFactory` without enabling the SDK's host allow-list option, leaving the server willing to honor any Host header value and making it trivially reachable via a DNS rebinding attack. Exploitation requires user interaction and a locally running tiger-slack instance; no public exploit code and no CISA KEV listing exist at time of analysis.
DNS rebinding against pg-aiguide's MCP HTTP transport (versions through 0.5.0) allows a remote unauthenticated attacker to access and control the locally-bound MCP server by exploiting the disabled host header allow-list in src/httpServer.ts. The underlying MCP SDK already provided DNS rebinding protection via a host allow-list option, but pg-aiguide's httpServerFactory call never enabled it, meaning every inbound Host header was accepted regardless of origin. No public exploit identified at time of analysis, though DNS rebinding is a well-documented attack class with readily available tooling.
DNS rebinding in mcp-go before 0.56.0 allows a malicious webpage to bypass localhost isolation and invoke tools or read resources on a victim's locally-running MCP server. Both StreamableHTTPServer and SSEServer accepted loopback connections without validating the Host header, and the SSE transport's permissive default CORS policy removed an additional browser-level barrier. No public exploit has been identified and no CISA KEV listing exists, but the attack is practical for any developer running an affected server while browsing the web.
DNS rebinding in genieacs-mcp's Streamable HTTP transport (versions <= 0.3.1) allows a malicious website to route browser requests through loopback to the unauthenticated /mcp listener and invoke arbitrary GenieACS NBI operations against managed CPE devices. Affected deployments expose full read/write access to TR-069 device state - including firmware update tasks, parameter changes, device reboots, presets, and connection requests - to any attacker who can lure the server operator to a malicious web page. A proof-of-concept is documented in the GitHub security advisory (GHSA-cmwv-wf9p-p8wx); no CISA KEV listing is present, indicating targeted rather than widespread exploitation at time of analysis.
Cross-site request forgery against the PraisonAI MCP HTTP-stream transport allows unauthenticated remote attackers to execute arbitrary MCP tools on a developer's local machine when a victim visits a malicious webpage. The attack is enabled by a flawed prefix-match origin check (`startswith`) in versions prior to 4.6.58 that accepts `http://localhost.attacker.com` as a valid localhost origin, and is further facilitated by the absence of a default API key and the CORS simple-request mechanism (Content-Type: text/plain) that bypasses browser preflight. The highest-impact consequence is persistent prompt injection: a forged request can write attacker-controlled agent instruction files that the runtime loads on every subsequent agent run. No public exploit is identified at time of analysis; vendor-released patch 4.6.58 is confirmed.
Origin validation bypass in Grav CMS before 2.0.16 lets remote attackers defeat the Referer-based same-origin check used by the Uri::referrer() and Pages::referrerRoute() methods. Because the check uses an unanchored str_starts_with() prefix match without a trailing delimiter, a request bearing a Referer from an attacker-controlled look-alike domain (e.g. https://example.com.attacker.tld) is accepted as same-origin, undermining CSRF/origin protections on protected routes. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Origin validation failure in Microsoft Edge (Chromium-based) enables unauthenticated remote attackers to bypass browser security features, resulting in limited cross-origin confidentiality and integrity impacts. The vulnerability (CWE-346) exploits improper validation of request origins within the Chromium-based browser engine and requires user interaction to trigger. No public exploit code has been identified at time of analysis, and Microsoft has released a patch via the MSRC update guide.
Spring Cloud Function's ServerlessHttpServletRequest.isSecure() method returns an unchecked result that does not reflect the actual HTTP transport scheme, enabling applications that gate security decisions on this call to behave incorrectly. Affected versions span three active release lines: 5.0.0-5.0.3, 4.3.0-4.3.4, and 4.2.0-4.2.7. No public exploit code exists and the vulnerability is not listed in CISA KEV; the vendor-assigned CVSS of 3.1 (Low) reflects constrained exploitation prerequisites including high privilege and user interaction.
DNS rebinding in Dropbox's mcp-server-dash (network mode) allows a malicious web page to reach the local MCP listener and invoke Dropbox API tools - company-search and file-detail - under the victim's stored Dropbox credential. The server bound to the loopback interface but performed no Host header validation, letting a browser issue cross-origin requests via a rebound domain that resolves to 127.0.0.1. No public exploit has been identified at time of analysis; CVSS 4.0 scores this at 2.3, reflecting the attack's prerequisites of user interaction and a specific deployment mode.
DNS rebinding in Timescale's tiger-gh-mcp-server allows an attacker-controlled web page to drive the victim's locally-bound GitHub MCP HTTP endpoint by exploiting the server's failure to validate Host headers. The src/httpServer.ts file called the shared httpServerFactory helper without passing the SDK's host allow-list option, meaning the server accepted any Host value - a prerequisite for classic DNS rebinding. An attacker who lures a developer running the server in HTTP mode to visit a malicious page can then invoke arbitrary GitHub MCP tools under the victim's authenticated session, including reading private repositories or issuing write operations. No public exploit has been identified and the vulnerability is not listed in CISA KEV.
DNS rebinding in tiger-slack's MCP HTTP transport exposes the locally running Slack MCP server to attacker-controlled browser requests. The root cause is that `mcp/src/httpServer.ts` invoked `httpServerFactory` without enabling the SDK's host allow-list option, leaving the server willing to honor any Host header value and making it trivially reachable via a DNS rebinding attack. Exploitation requires user interaction and a locally running tiger-slack instance; no public exploit code and no CISA KEV listing exist at time of analysis.
DNS rebinding against pg-aiguide's MCP HTTP transport (versions through 0.5.0) allows a remote unauthenticated attacker to access and control the locally-bound MCP server by exploiting the disabled host header allow-list in src/httpServer.ts. The underlying MCP SDK already provided DNS rebinding protection via a host allow-list option, but pg-aiguide's httpServerFactory call never enabled it, meaning every inbound Host header was accepted regardless of origin. No public exploit identified at time of analysis, though DNS rebinding is a well-documented attack class with readily available tooling.
DNS rebinding in mcp-go before 0.56.0 allows a malicious webpage to bypass localhost isolation and invoke tools or read resources on a victim's locally-running MCP server. Both StreamableHTTPServer and SSEServer accepted loopback connections without validating the Host header, and the SSE transport's permissive default CORS policy removed an additional browser-level barrier. No public exploit has been identified and no CISA KEV listing exists, but the attack is practical for any developer running an affected server while browsing the web.
DNS rebinding in genieacs-mcp's Streamable HTTP transport (versions <= 0.3.1) allows a malicious website to route browser requests through loopback to the unauthenticated /mcp listener and invoke arbitrary GenieACS NBI operations against managed CPE devices. Affected deployments expose full read/write access to TR-069 device state - including firmware update tasks, parameter changes, device reboots, presets, and connection requests - to any attacker who can lure the server operator to a malicious web page. A proof-of-concept is documented in the GitHub security advisory (GHSA-cmwv-wf9p-p8wx); no CISA KEV listing is present, indicating targeted rather than widespread exploitation at time of analysis.
Cross-site request forgery against the PraisonAI MCP HTTP-stream transport allows unauthenticated remote attackers to execute arbitrary MCP tools on a developer's local machine when a victim visits a malicious webpage. The attack is enabled by a flawed prefix-match origin check (`startswith`) in versions prior to 4.6.58 that accepts `http://localhost.attacker.com` as a valid localhost origin, and is further facilitated by the absence of a default API key and the CORS simple-request mechanism (Content-Type: text/plain) that bypasses browser preflight. The highest-impact consequence is persistent prompt injection: a forged request can write attacker-controlled agent instruction files that the runtime loads on every subsequent agent run. No public exploit is identified at time of analysis; vendor-released patch 4.6.58 is confirmed.
Origin validation bypass in Grav CMS before 2.0.16 lets remote attackers defeat the Referer-based same-origin check used by the Uri::referrer() and Pages::referrerRoute() methods. Because the check uses an unanchored str_starts_with() prefix match without a trailing delimiter, a request bearing a Referer from an attacker-controlled look-alike domain (e.g. https://example.com.attacker.tld) is accepted as same-origin, undermining CSRF/origin protections on protected routes. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.