Description

pg-aiguide started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named. A page in a browser could therefore point a name it controlled at the address the server was bound to and drive the locally reachable MCP server through the visitor's browser. The protection was already available in the packaged transport and simply not turned on, so updating the dependency alone would not have closed it. Version 0.5.1 passes the option explicitly.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-27T17:20:51.803Z",
  "pubdate": "2026-08-27T17:20:51.803Z",
  "executiveSummary": "The pg-aiguide project is susceptible to a DNS rebinding vulnerability arising from an improperly configured MCP HTTP transport. By failing to enable the built-in host allow-list provided by the underlying SDK, the application exposes itself to unauthorized cross-origin requests.\nThis vulnerability allows an attacker to bypass browser-based same-origin policy restrictions. An attacker can direct a victim's browser to an attacker-controlled domain that resolves to the local address where the MCP server is bound, effectively granting the attacker the ability to interact with the locally running MCP server.\nThe risk is critical for users running local instances of the MCP server, as it enables remote attackers to perform unauthorized actions on the local host by leveraging the victim's authenticated browser session. Exploitation requires no special authentication, relying purely on the user visiting a malicious webpage while the vulnerable MCP server is active.\nThis issue was addressed by ensuring the DNS-rebinding-protection option is explicitly configured in version 0.5.1.",
  "technicalDetails": "The vulnerability resides within the MCP HTTP transport implementation of pg-aiguide, specifically in how it initializes its server instances. The root cause is the omission of the host allow-list configuration within the httpServerFactory helper function called in src/httpServer.ts. By failing to set the required DNS-rebinding-protection option, the transport defaults to an permissive state where it accepts incoming requests regardless of the Host header provided in the HTTP request.\nThe attack flow leverages the inherent trust placed in local loopback interfaces. When a user visits a malicious website, the attacker can use DNS rebinding techniques to induce the victim's browser to send requests to an arbitrary IP address, in this case, the localhost address bound to the MCP server. Because the server fails to validate the Host header against a whitelist, it processes these requests as legitimate, despite the request originating from a cross-origin context controlled by the attacker.\nThe vulnerable component is the improperly configured MCP HTTP transport logic found in src/httpServer.ts. This flaw affects versions prior to 0.5.1. The lack of origin validation means the server does not distinguish between requests originating from legitimate, trusted clients and those initiated by malicious scripts executing within a user's browser.\nSuccessful exploitation allows for a remote attacker to drive the MCP server's functionality without any prior authentication. The impact is significant because the MCP server likely handles sensitive tools or data locally; by bypassing the host check, the attacker essentially gains an interface to interact with these tools remotely. The browser acts as an unintentional proxy, forwarding the attacker's commands to the local server. The payload behavior involves crafting specific HTTP requests that target the MCP endpoints; if the user's browser has existing credentials or context for the local environment, those may be leveraged to perform unauthorized operations. Post-exploitation impact includes potential data exfiltration, command execution, or other unintended interactions with the services managed by the pg-aiguide MCP server, as the server treats the attacker's traffic as coming from a trusted local source."
}