CVE-2026-81099: Timescale tiger-slack DNS Rebinding via Disabled Host Header Allow-List
tiger-slack started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. mcp/src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, and a page in a browser could point a name it controlled at the address the server was bound to and drive the locally reachable Slack MCP server through the visitor's browser. The fix passes the option explicitly alongside a dependency update; the update alone would not have closed it. The repository publishes no release that brackets the fix, so the affected boundary is the commit preceding it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Enable the underlying SDK DNS-rebinding-protection option (host allow-list) for tiger-slack’s MCP HTTP transport so the server enforces an allowed Host header instead of accepting requests for any host.
tiger-slack (Slack MCP HTTP transport) DNS-rebinding-protection / disabled host header allow-list option = enabled
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Users running the tiger-slack MCP HTTP transport on an address reachable from their browser are exposed. A malicious web page can exploit DNS rebinding to send requests to the locally reachable Slack MCP server.
What does an attacker need to exploit it?
The attacker needs to lure a user to a page in a browser and control a hostname that can be rebound to the address where the MCP server is listening. No attacker privileges are required, but user interaction is required.
Does updating the underlying SDK alone fix the problem?
No. The fix requires tiger-slack to explicitly enable the SDK's DNS-rebinding-protection host allow-list option; the dependency update by itself does not close the issue.
How can I determine whether my deployment is affected?
Review mcp/src/httpServer.ts and the call to the shared httpServerFactory helper. The deployment is affected if the MCP HTTP transport is started without explicitly setting the DNS-rebinding-protection option that enables the host allow-list.