CVE-2026-63118
2026-07-29
20h17 +00:00
20h17 +00:00
特定のCVEの通知
特定のCVEの変更情報をいち早くお届けします。
CVE の説明
MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not validate the HTTP Host or Origin request headers, which allows a malicious browser page to use DNS rebinding to reach a locally running MCP server and invoke exposed tools. This issue is fixed in version 0.23.0.
CVE の情報
関連する弱点
| 弱点名 | 出典 | |
|---|---|---|
| Origin Validation Error The product does not properly verify that the source of data or communication is valid. |
||
| Reliance on Reverse DNS Resolution for a Security-Critical Action The product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname. |
