CVE-2026-62863

Name of the Vulnerable Software and Affected Versions MoLing versions prior to 0.5.0

Description When running in SSE mode using the -l flag, the /sse and /message HTTP endpoints do not authenticate requests. Additionally, the mcp-go dependency configures Access-Control-Allow-Origin: *, which allows cross-origin requests. A malicious web page can establish a cross-origin EventSource connection to the /sse endpoint to obtain a sessionId. This sessionId can then be used to send unauthorized MCP tool calls to the /message endpoint. Depending on the tools configured, an attacker could execute commands, read or write local files, or perform other unauthorized actions. This browser-mediated attack remains possible even if the server is bound only to the loopback address.

Recommendations Update MoLing to version 0.5.0.