CVE-2026-109823

The tidewave application (versions 0.8.0 before 0.9.2 ) is vulnerable to host filesystem path disclosure via DNS rebinding . Because responses to /tidewave/connect and the rendered toolbar do not verify the Host header , an attacker can use a web page that rebinds its domain to the loopback addre...