CVE-2026-63118
2026-07-29
20h17 +00:00
20h17 +00:00
특정 CVE 알림
특정 CVE의 변경 사항에 대한 정보를 받아보세요.
CVE 설명
MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not validate the HTTP Host or Origin request headers, which allows a malicious browser page to use DNS rebinding to reach a locally running MCP server and invoke exposed tools. This issue is fixed in version 0.23.0.
CVE 정보
관련 약점
| 약점 이름 | 출처 | |
|---|---|---|
| Origin Validation Error The product does not properly verify that the source of data or communication is valid. |
||
| Reliance on Reverse DNS Resolution for a Security-Critical Action The product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname. |
