CVE-2026-62863

MoLing is a computer-use and browser-use based MCP server. Prior to 0.5.0, when MoLing runs in SSE mode using -l, its /sse and /message HTTP endpoints do not authenticate requests and the mcp-go dependency sets Access-Control-Allow-Origin: . A malicious web page can open a cross-origin EventSourc...

CVE-2026-62863

The MoLing MCP server (prior to version 0.5.0 ) is vulnerable to unauthorized tool execution due to unauthenticated SSE and wildcard CORS settings. When running in SSE mode using the -l flag, the /sse and /message endpoints fail to authenticate requests, and the mcp-go dependency sets Access-Cont...

CVE-2026-62863: gojue moling: MoLing is a computer-use and browser-use based MCP server

MoLing is a computer-use and browser-use based MCP server. Prior to 0.5.0, when MoLing runs in SSE mode using -l, its /sse and /message HTTP endpoints do not authenticate requests and the mcp-go dependency sets Access-Control-Allow-Origin: . A malicious web page can open a cross-origin EventSourc...