CVE-2026-77339
2026-09-18
17h17 +00:00
17h17 +00:00
특정 CVE 알림
특정 CVE의 변경 사항에 대한 정보를 받아보세요.
CVE 설명
Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listener in src/mcp/server.go accepts browser-origin requests to /sse and the returned message endpoint without validating the Host header, validating the Origin header, or authenticating the caller. When MCP SSE is enabled, a malicious website can use DNS rebinding to reach the loopback listener and issue MCP requests. If expose_control_tools is enabled, the attacker can enumerate process state, read or search logs, truncate logs, and start, stop, restart, or scale local processes; configured user-defined tools can expose additional commands and output. The Gin REST API token middleware does not protect this separately started MCP listener. This issue is fixed in version 1.120.0.
CVE 정보
관련 약점
| 약점 이름 | 출처 | |
|---|---|---|
| Missing Authentication for Critical Functionality The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
||
| Origin Validation Error The product does not properly verify that the source of data or communication is valid. |
