Avishai Gonen

**Name of the Vulnerable Software and Affected Versions** mcp-go versions prior to 0.56.0 **Description** The software accepts requests on its HTTP transports without validating the Host header. Specifically, the `StreamableHTTPServer.ServeHTTP` function in `server/streamable http.go` and the `SSEServer.ServeHTTP` function in `server/sse.go` process any request arriving over a loopback connection regardless of the specified host. Additionally, the Server-Sent Events (SSE) transport default configuration allows any origin. This allows a browser-based page to point a controlled name to the loopback address and access the server, potentially invoking tools and reading resources intended only for local software. **Recommendations** Update to version 0.56.0.

**Name of the Vulnerable Software and Affected Versions** pg-aiguide versions prior to 0.5.1 **Description** The MCP HTTP transport was started without enabling the host allow-list provided by the underlying SDK. Specifically, the `httpServer.ts` file called the `httpServerFactory()` helper without setting the `DNS-rebinding-protection` option. This allows the transport to accept requests regardless of the host name provided. Consequently, a malicious webpage could use DNS rebinding—a technique that bypasses the Same-Origin Policy by changing the IP address associated with a domain name—to point a controlled name to the server's address and interact with the locally reachable MCP server via the visitor's browser. **Recommendations** Update to version 0.5.1.

**Name of the Vulnerable Software and Affected Versions** ToolUniverse versions prior to 1.3.0 **Description** The software executes caller-supplied Python code within a sandbox that can be escaped. The executor in `python executor tool.py` uses a denied list for attribute names and calls but fails to block dunder attributes accessed via string lookups or permitted modules. This allows an attacker to navigate from a literal's class to its base and enumerate subclasses to gain references to the `process` and `subprocess` modules. Additionally, a per-call argument allows the caller to expand the import allow-list before inspection. The HTTP and MCP servers in `http api server.py` and `smcp server.py` bind to all interfaces with debugging enabled and no authentication, allowing any user with network access to the port to execute code as the server process. **Recommendations** Update to version 1.3.0.

**Name of the Vulnerable Software and Affected Versions** Software versions 1.4.0 through 1.6.0 **Description** The `execute ruby` tool, designed as a read-only Ruby sandbox, uses a pattern denylist and replacements for process-spawning methods on `Kernel` to restrict execution. However, spawn entry points within the pseudo-terminal library are not included in the denylist or replaced. This allows a tool call to access these entry points and start a shell, enabling the execution of commands as the account running the server, bypassing the guarded methods. **Recommendations** Update to version 1.6.1 to restrict permitted requires to a data-only list and block dynamic dispatch to execution entry points. Update to version 2.0.0 to remove the tool entirely.

**Name of the Vulnerable Software and Affected Versions** Telnyx MCP server (affected versions not specified) **Description** The HTTP transport was exposed on all network interfaces and did not require caller credentials. In the file `packages/mcp-server/src/http.ts`, the server served the Model Context Protocol (MCP) on the root path with a listener bound to all interfaces. The authentication header parsing logic did not fail when credentials were absent, allowing unauthenticated requests to complete initialization and dispatch tools. Consequently, the server forwarded its own stored credentials, including the Telnyx API key, client secret, and code-execution key, to the upstream endpoint, allowing any caller with network access to the port to act with these privileges. **Recommendations** Update the server to a version where the host defaults to loopback, a server API key is required, and enforcement is handled via middleware.

tiger-slack started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. mcp/src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, and a page in a browser could point a name it controlled at the address the server was bound to and drive the locally reachable Slack MCP server through the visitor's browser. The fix passes the option explicitly alongside a dependency update; the update alone would not have closed it. The repository publishes no release that brackets the fix, so the affected boundary is the commit preceding it.

**Name of the Vulnerable Software and Affected Versions** tiger-gh-mcp-server versions prior to the commit that implemented the fix **Description** The MCP HTTP transport was started without enabling the host allow-list provided by the underlying SDK. Specifically, the `httpServer.ts` file called the `httpServerFactory()` helper without setting the `DNS-rebinding-protection` option. This allows the transport to accept requests regardless of the host name provided, enabling a DNS rebinding attack where a locally reachable GitHub MCP endpoint can be controlled via a visitor's browser pointing a controlled name to the bound address. DNS rebinding is a technique used to bypass the Same-Origin Policy (SOP) to interact with local services. **Recommendations** Update the software to the version containing the fix that explicitly passes the `DNS-rebinding-protection` option and includes the necessary dependency update.

**Name of the Vulnerable Software and Affected Versions** versions prior to 0.2.5 **Description** The `configure` command allows the storage of arbitrary endpoint URLs alongside the user's access token. Specifically, the `ConfigureCommand.execute()` function in `src/cli.ts` saves the value provided to the `endpoint` option into the user profile without utilizing the `createSafeUrl()` function in `src/config.ts`, which is designed to restrict settings to authorized vendor hosts over HTTPS. Since the connection logic in `src/mcp.ts` attaches the stored token as a bearer credential to every request sent to the configured endpoint, an attacker could persuade a user to configure a malicious endpoint, resulting in the user's personal access token being sent to the attacker on every subsequent invocation. **Recommendations** Update to version 0.2.5.

**Name of the Vulnerable Software and Affected Versions** Dash MCP server (affected versions not specified) **Description** In network mode, the server binds its listener to the loopback address but fails to verify the host name of incoming requests. Within `src/mcp server dash.py`, the server is configured without transport-security settings, allowing requests directed at the loopback address to reach the listener even if they carry an attacker-controlled host name. This allows a malicious webpage in a visitor's browser to interact with the local server and execute the `company-search` and `file-detail` tools using the server's Dropbox credentials. This issue only affects the network mode and does not impact the standard input mode. **Recommendations** Update the server to the latest commit that implements transport-security settings to enable host checking and restrict access to the loopback name and port. As a temporary mitigation, avoid using the network mode and use the standard input mode instead.

**Name of the Vulnerable Software and Affected Versions** UI-TARS-desktop mcp-http-server version 1.2.4 (prior to commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168) **Description** The `startServer.ts` file in the `mcp-http-server` package defaults the listen address to `::` when no host is provided. This causes the `startSseAndStreamableHttpMcpServer` function to bind Streamable HTTP and SSE MCP transports to every network interface. Because authentication middleware is optional and not supplied by the `@agent-infra/mcp-server-commands` and `@agent-infra/mcp-server-filesystem` entry points, these servers do not require credentials. Consequently, an unauthenticated client can access the `run command` tool, which passes input to `promisify(child process.exec)`, allowing arbitrary command execution as the user running the server. Similarly, the filesystem server exposes file read and write tools to unauthenticated users. **Recommendations** Update the `mcp-http-server` package to the version containing commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168 to ensure the listen address defaults to 127.0.0.1.