CVE-2026-81095: Timescale pg-aiguide through 0.5.0 DNS Rebinding via Disabled Host Header Allow-List
pg-aiguide started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named. A page in a browser could therefore point a name it controlled at the address the server was bound to and drive the locally reachable MCP server through the visitor's browser. The protection was already available in the packaged transport and simply not turned on, so updating the dependency alone would not have closed it. Version 0.5.1 passes the option explicitly.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pg-aiguideto a version that resolves this vulnerability.Fixed in 0.5.1 - Configuration
In src/httpServer.ts, call the shared httpServerFactory and set/pass the DNS-rebinding-protection option so the MCP HTTP transport enables the host allow-list provided by the underlying SDK (v0.5.1 does this explicitly; v0.5.0 did not).
pg-aiguide MCP HTTP transport (src/httpServer.ts / httpServerFactory) DNS-rebinding-protection = enabled / option passed explicitly
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running pg-aiguide through version 0.5.0 are affected when its MCP HTTP transport is reachable from a visitor's browser, including when the server is bound to a locally reachable address.
What must an attacker do to exploit this issue?
The attacker must induce a victim to visit a browser page under a name the attacker controls and point that name at the address where the MCP server is bound. Exploitation requires user interaction and has high attack complexity.
Does updating the underlying transport dependency alone mitigate the issue?
No. The host-header allow-list protection was already present in the packaged transport but was not enabled by pg-aiguide, so a dependency-only update would not close the issue.
What version contains the fix?
Version 0.5.1 explicitly enables the DNS-rebinding-protection option when starting the HTTP transport.