CVE-2026-63118
2026-07-29
20h17 +00:00
20h17 +00:00
指定 CVE 通知
随时了解指定 CVE 的变更。
CVE 描述
MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not validate the HTTP Host or Origin request headers, which allows a malicious browser page to use DNS rebinding to reach a locally running MCP server and invoke exposed tools. This issue is fixed in version 0.23.0.
CVE 信息
相关弱点
| 弱点名称 | 来源 | |
|---|---|---|
| Origin Validation Error The product does not properly verify that the source of data or communication is valid. |
||
| Reliance on Reverse DNS Resolution for a Security-Critical Action The product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname. |
