CVE-2026-81100

tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, making t...

CVE-2026-81098

The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller credential. packages/mcp-server/src/http.ts served MCP on the root path with a listener bound to all interfaces and parsed the caller's authentication headers in a mode that did not fail when they wer...

CVE-2026-81102

The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcpserverdash.py constructed the server for its network mode with the interface restricted to loopback and no transport-security settings, so a name that had been pointed at the loopback...

CVE-2026-81095

pg-aiguide started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named. A page in a brows...

CVE-2026-81092

mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamablehttp.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection regardless of the host it named, and the SSE transport's...

CVE-2026-81099

Timescale's tiger-slack failed to enable the DNS-rebinding-protection option when starting its MCP HTTP transport in mcp/src/httpServer.ts, leaving the host allow-list disabled. This allowed a malicious web page to use DNS rebinding to steer requests to the locally bound Slack MCP server through ...

CVE-2026-81100 Timescale tiger-gh-mcp-server DNS Rebinding via Disabled Host Header Allow-List

tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, making t...

CVE-2026-81100

tiger-gh-mcp-server (by Timescale) started its MCP HTTP transport without enabling the DNS-rebinding-protection option provided by the underlying SDK. The file src/httpServer.ts called the shared httpServerFactory helper but never set the host allow-list, so the transport accepted requests regard...

CVE-2026-81100 Timescale tiger-gh-mcp-server DNS Rebinding via Disabled Host Header Allow-List

tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, making t...

CVE-2026-81099 Timescale tiger-slack DNS Rebinding via Disabled Host Header Allow-List

tiger-slack started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. mcp/src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, and a page i...

EUVD-2026-67028

tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, making t...

CVE-2026-81099 Timescale tiger-slack DNS Rebinding via Disabled Host Header Allow-List

tiger-slack started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. mcp/src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, and a page i...

CVE-2026-81100 Timescale tiger-gh-mcp-server DNS Rebinding via Disabled Host Header Allow-List

tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, making t...

CVE-2026-81099 Timescale tiger-slack DNS Rebinding via Disabled Host Header Allow-List

tiger-slack started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. mcp/src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, and a page i...

EUVD-2026-67026

The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller credential. packages/mcp-server/src/http.ts served MCP on the root path with a listener bound to all interfaces and parsed the caller's authentication headers in a mode that did not fail when they wer...

CVE-2026-81098 Telnyx MCP Server through 6.83.0 Missing Authentication on Streamable HTTP Transport

The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller credential. packages/mcp-server/src/http.ts served MCP on the root path with a listener bound to all interfaces and parsed the caller's authentication headers in a mode that did not fail when they wer...

CVE-2026-81098

The Telnyx MCP server (telnyx-node package through 6.83.0 ) exposed its Streamable HTTP transport on all network interfaces without requiring caller credentials. The vulnerable component, packages/mcp-server/src/http.ts, bound its listener to every interface and parsed authentication headers in a...

CVE-2026-81098 Telnyx MCP Server through 6.83.0 Missing Authentication on Streamable HTTP Transport

The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller credential. packages/mcp-server/src/http.ts served MCP on the root path with a listener bound to all interfaces and parsed the caller's authentication headers in a mode that did not fail when they wer...

CVE-2026-81098

The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller credential. packages/mcp-server/src/http.ts served MCP on the root path with a listener bound to all interfaces and parsed the caller's authentication headers in a mode that did not fail when they wer...

CVE-2026-81095 Timescale pg-aiguide through 0.5.0 DNS Rebinding via Disabled Host Header Allow-List

pg-aiguide started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named. A page in a brows...