EUVD-2026-50501

MCP Ruby SDK: Ruby SSE Session Poisoning...

CVE-2026-63118

The MCP Ruby SDK (mcp gem) contains a DNS rebind vulnerability in MCP::Server::Transports::StreamableHTTPTransport where HTTP Host/Origin are not validated. This allows a malicious page to bind a victim’s locally running MCP server to a loopback/ LAN address and post JSON‑RPC requests to exposed ...

PT-2026-65898

Name of the Vulnerable Software and Affected Versions mcp versions prior to 0.23.0 Description The MCP::Server::Transports::StreamableHTTPTransport component in the mcp gem fails to bind a session ID to a session owner. This allows an attacker who has obtained a stolen session ID to send tools/ca...