https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 02:31:14 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-327321 EUVD-2026-327321 https://cve.radiocsirt.org/vuln/euvd-2026-327321 https://cve.radiocsirt.org/vuln/fkie_cve-2026-11624 <p>The Model Context Protocol has a security warning advising servers to validate the &#34;Origin&#34; header on all incoming connections to prevent DNS rebinding attacks. Prior to the v0.25.0 release, users had no way to validate the origin&#39;s host. In v0.25.0, a new &#34;--allowed-hosts&#34; flag was introduced alongside the existing &#34;--allowed-origins&#34; flag, enabling users to specify permitted hosts at server startup. Both flags default to &#34;*&#34;, allowing users to implement strict access controls as needed without breaking existing setups. If either flag is set to &#34;*&#34;, the server will output a startup warning about potential vulnerabilities. Documentation has also been updated to highlight these security considerations.</p> <p>The Model Context Protocol has a security warning advising servers to validate the &#34;Origin&#34; header on all incoming connections to prevent DNS rebinding attacks. Prior to the v0.25.0 release, users had no way to validate the origin&#39;s host. In v0.25.0, a new &#34;--allowed-hosts&#34; flag was introduced alongside the existing &#34;--allowed-origins&#34; flag, enabling users to specify permitted hosts at server startup. Both flags default to &#34;*&#34;, allowing users to implement strict access controls as needed without breaking existing setups. If either flag is set to &#34;*&#34;, the server will output a startup warning about potential vulnerabilities. Documentation has also been updated to highlight these security considerations.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-11624 https://cve.radiocsirt.org/vuln/ghsa-76g7-m3xw-x9gr <p><strong>Affected:</strong> Go: github.com/googleapis/mcp-toolbox</p> <p>The Model Context Protocol has a security warning advising servers to validate the &#34;Origin&#34; header on all incoming connections to prevent DNS rebinding attacks. Prior to the v0.25.0 release, users had no way to validate the origin&#39;s host. In v0.25.0, a new &#34;--allowed-hosts&#34; flag was introduced alongside the existing &#34;--allowed-origins&#34; flag, enabling users to specify permitted hosts at server startup. Both flags default to &#34;*&#34;, allowing users to implement strict access controls as needed without breaking existing setups. If either flag is set to &#34;*&#34;, the server will output a startup warning about potential vulnerabilities. Documentation has also been updated to highlight these security considerations.</p> <p><strong>Affected:</strong> Go: github.com/googleapis/mcp-toolbox</p> <p>The Model Context Protocol has a security warning advising servers to validate the &#34;Origin&#34; header on all incoming connections to prevent DNS rebinding attacks. Prior to the v0.25.0 release, users had no way to validate the origin&#39;s host. In v0.25.0, a new &#34;--allowed-hosts&#34; flag was introduced alongside the existing &#34;--allowed-origins&#34; flag, enabling users to specify permitted hosts at server startup. Both flags default to &#34;*&#34;, allowing users to implement strict access controls as needed without breaking existing setups. If either flag is set to &#34;*&#34;, the server will output a startup warning about potential vulnerabilities. Documentation has also been updated to highlight these security considerations.</p> https://cve.radiocsirt.org/vuln/ghsa-76g7-m3xw-x9gr