Agents
A web page can DNS-rebind into your local process-compose MCP listener and drive its tools
CVE-2026-77339 (GHSA-5gm3-9crp-6g3v, published 2026-09-18) covers process-compose, the process orchestrator many developers keep running locally. When MCP SSE is enabled, the SSE transport accepts browser-origin requests and dispatches them into process-compose MCP tools before any Host check, Origin check or caller-secret check runs, so a malicious website can DNS-rebind to the listener and invoke tools. The interesting detail for anyone wiring MCP into an existing service: the project's REST API is protected by token middleware, but the MCP listener is started separately and inherits none of it, and SSE is the default transport when mcp_server.transport is omitted.
↳ Follow the thread