Description

tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, making the locally reachable GitHub MCP endpoint drivable from a page in a visitor's browser that pointed a name it controlled at the bound address. The fix passes the option explicitly alongside a dependency update; the update alone would not have closed it. The repository has published no release that brackets the fix, so the affected boundary is the commit preceding it.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-27T17:20:52.620Z",
  "pubdate": "2026-08-27T17:20:52.620Z",
  "executiveSummary": "The tiger-gh-mcp-server is susceptible to a DNS rebinding vulnerability due to an improperly configured HTTP transport layer. The application fails to restrict incoming requests by host header, allowing a malicious actor to perform unauthorized interactions with the locally running MCP server. By exploiting the lack of a host allow-list, an attacker can coerce a visitor's browser into sending authenticated requests to the service if the victim visits a malicious domain that resolves to the local host. This vulnerability stems from the failure to enable the built-in DNS-rebinding-protection provided by the underlying SDK within the httpServerFactory helper. The impact is significant, as it allows remote attackers to drive the locally reachable GitHub MCP endpoint, potentially executing unintended actions or accessing sensitive data via the victim's browser context. The risk is heightened by the absence of release-based versioning, making all commits prior to the security patch inherently vulnerable. Exploitation requires no special authentication from the attacker, relying instead on the victim's interaction with a malicious website and the browser's ability to reach the local MCP server instance.",
  "technicalDetails": "The vulnerability originates in src/httpServer.ts within the tiger-gh-mcp-server, where the httpServerFactory helper is initialized to manage MCP HTTP transport. The root cause is the omission of the DNS-rebinding-protection option when invoking the factory function. In modern SDK implementations for MCP servers, the transport layer requires explicit configuration to validate the 'Host' header of incoming HTTP requests against a pre-defined allow-list. By failing to set this configuration, the server accepts requests regardless of the hostname provided in the request headers.\nThe attack flow leverages the browser-based nature of DNS rebinding. An attacker first registers a domain and sets a low Time-to-Live (TTL) on its DNS records. Initially, the domain resolves to an attacker-controlled server. Once the victim visits the malicious site, the site triggers a script that forces the browser to re-resolve the domain, this time pointing to the loopback address (e.g., 127.0.0.1) or the local network address where the tiger-gh-mcp-server is listening. Because the MCP server does not enforce host header validation, it treats the subsequent requests originating from the victim's browser as legitimate traffic directed at the local MCP endpoint.\nThe component affected is the HTTP transport implementation, specifically the initialization logic in src/httpServer.ts. The lack of strict host validation effectively bypasses Same-Origin Policy (SOP) protections that might otherwise prevent cross-site interactions. Because the MCP server is designed to provide access to GitHub resources, an attacker can abuse this access to perform actions on behalf of the user, provided the user's environment has existing authentication contexts that the MCP server utilizes. This does not require the attacker to have direct network access to the target machine; the victim's browser acts as a proxy, executing requests within the internal network segment. The vulnerability is present in all commits preceding the fix that explicitly passes the DNS-rebinding-protection flag. While a dependency update was performed alongside the fix, the update alone is insufficient; the architectural change to the httpServerFactory call is the necessary remediation to enforce header verification and block unauthorized rebinding attempts."
}