Moling
Monthly
MoLing's SSE server mode (enabled with the non-default -l/ListenAddr flag) exposes the /sse and /message HTTP endpoints without authentication, and the mcp-go dependency hardcodes Access-Control-Allow-Origin: * on /sse, so any web page the victim visits can open a cross-origin EventSource, read the endpoint event, extract the unauthenticated sessionId, and then post unauthorized MCP tool calls to /message. Impact is bounded by which MCP tools are configured but can include local file read/write and command execution, and the vendor notes that binding only to loopback does not stop this because the attack is browser-mediated from the victim's own machine. Versions before 0.5.0 are affected; 0.5.0 adds mandatory token authentication and strips the wildcard CORS header. Exploitation requires the victim to run SSE mode and visit an attacker-controlled page (UI:R); no public exploit code or confirmed active exploitation is identified in the available data, though the advisory includes a simplified proof-of-concept snippet, so a public PoC reference exists but is not verified as working exploit code. The priority decision label is act_now.
MoLing's SSE server mode (enabled with the non-default -l/ListenAddr flag) exposes the /sse and /message HTTP endpoints without authentication, and the mcp-go dependency hardcodes Access-Control-Allow-Origin: * on /sse, so any web page the victim visits can open a cross-origin EventSource, read the endpoint event, extract the unauthenticated sessionId, and then post unauthorized MCP tool calls to /message. Impact is bounded by which MCP tools are configured but can include local file read/write and command execution, and the vendor notes that binding only to loopback does not stop this because the attack is browser-mediated from the victim's own machine. Versions before 0.5.0 are affected; 0.5.0 adds mandatory token authentication and strips the wildcard CORS header. Exploitation requires the victim to run SSE mode and visit an attacker-controlled page (UI:R); no public exploit code or confirmed active exploitation is identified in the available data, though the advisory includes a simplified proof-of-concept snippet, so a public PoC reference exists but is not verified as working exploit code. The priority decision label is act_now.