EUVD-2026-67023
GHSA-x76c-qpjv-crcp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
DNS rebinding requires precise timing and victim browser interaction (AC:H, UI:R); access crosses from the browser origin into the local MCP server (S:C); no authentication required and no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
pg-aiguide started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named. A page in a browser could therefore point a name it controlled at the address the server was bound to and drive the locally reachable MCP server through the visitor's browser. The protection was already available in the packaged transport and simply not turned on, so updating the dependency alone would not have closed it. Version 0.5.1 passes the option explicitly.
AnalysisAI
DNS rebinding against pg-aiguide's MCP HTTP transport (versions through 0.5.0) allows a remote unauthenticated attacker to access and control the locally-bound MCP server by exploiting the disabled host header allow-list in src/httpServer.ts. The underlying MCP SDK already provided DNS rebinding protection via a host allow-list option, but pg-aiguide's httpServerFactory call never enabled it, meaning every inbound Host header was accepted regardless of origin. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim must have pg-aiguide version 0.5.0 or earlier installed with its MCP HTTP transport actively running at the time of the attack, and must visit an attacker-controlled web page in a browser during that window (UI:P in CVSS 4.0). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.6 (AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N) reflects network-accessible, unauthenticated exploitation with passive user interaction and specific attack requirements (AT:P captures the DNS rebinding timing constraint). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker serves a malicious web page whose JavaScript performs DNS rebinding: the attacker's domain initially resolves externally, delivers the exploit script, then the DNS TTL is allowed to expire and the record is updated to resolve to 127.0.0.1. The victim's browser subsequently treats requests to that domain as same-origin and forwards them to the local pg-aiguide MCP HTTP server, which accepts them without host header validation, granting the attacker read and write access to the MCP interface. … |
| Remediation | Upgrade pg-aiguide to version 0.5.1, which explicitly passes the DNS-rebinding-protection host allow-list option in the httpServerFactory call within src/httpServer.ts. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all systems running pg-aiguide 0.5.0 and earlier, and implement firewall rules restricting inbound access to the MCP HTTP transport to trusted networks only; if MCP HTTP transport is not operationally necessary, disable it entirely. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today