CVE-2026-77339
2026-09-18
17h17 +00:00
17h17 +00:00
Thông báo cho một CVE
Luôn được thông báo về mọi thay đổi đối với một CVE cụ thể.
Mô tả CVE
Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listener in src/mcp/server.go accepts browser-origin requests to /sse and the returned message endpoint without validating the Host header, validating the Origin header, or authenticating the caller. When MCP SSE is enabled, a malicious website can use DNS rebinding to reach the loopback listener and issue MCP requests. If expose_control_tools is enabled, the attacker can enumerate process state, read or search logs, truncate logs, and start, stop, restart, or scale local processes; configured user-defined tools can expose additional commands and output. The Gin REST API token middleware does not protect this separately started MCP listener. This issue is fixed in version 1.120.0.
Thông tin CVE
Điểm yếu liên quan
| Tên điểm yếu | Nguồn | |
|---|---|---|
| Missing Authentication for Critical Functionality The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
||
| Origin Validation Error The product does not properly verify that the source of data or communication is valid. |
