https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 12:12:42 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-322382 EUVD-2026-322382 https://cve.radiocsirt.org/vuln/euvd-2026-322382 https://cve.radiocsirt.org/vuln/fkie_cve-2026-9739 <p>Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we implemented `allowed-origins` and `allowed-hosts` flags to align with MCP security guidelines. However, the hardcoded `Access-Control-Allow-Origin: *` header in the SSE initialization handler was inadvertently retained. This vulnerability specifically impacts users connecting via Toolbox using SSE under specification v2024-11-05.</p> <p>Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we implemented `allowed-origins` and `allowed-hosts` flags to align with MCP security guidelines. However, the hardcoded `Access-Control-Allow-Origin: *` header in the SSE initialization handler was inadvertently retained. This vulnerability specifically impacts users connecting via Toolbox using SSE under specification v2024-11-05.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-9739 https://cve.radiocsirt.org/vuln/ghsa-7pf3-8xx7-rvhf <p><strong>Affected:</strong> Go: github.com/googleapis/mcp-toolbox</p> <p>Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we implemented `allowed-origins` and `allowed-hosts` flags to align with MCP security guidelines. However, the hardcoded `Access-Control-Allow-Origin: *` header in the SSE initialization handler was inadvertently retained. This vulnerability specifically impacts users connecting via Toolbox using SSE under specification v2024-11-05.</p> <p><strong>Affected:</strong> Go: github.com/googleapis/mcp-toolbox</p> <p>Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we implemented `allowed-origins` and `allowed-hosts` flags to align with MCP security guidelines. However, the hardcoded `Access-Control-Allow-Origin: *` header in the SSE initialization handler was inadvertently retained. This vulnerability specifically impacts users connecting via Toolbox using SSE under specification v2024-11-05.</p> https://cve.radiocsirt.org/vuln/ghsa-7pf3-8xx7-rvhf