CVE-2026-81100: Timescale tiger-gh-mcp-server DNS Rebinding via Disabled Host Header Allow-List
tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, making the locally reachable GitHub MCP endpoint drivable from a page in a visitor's browser that pointed a name it controlled at the bound address. The fix passes the option explicitly alongside a dependency update; the update alone would not have closed it. The repository has published no release that brackets the fix, so the affected boundary is the commit preceding it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update tiger-gh-mcp-server so that when src/httpServer.ts starts the MCP HTTP transport (through the shared httpServerFactory helper), it explicitly sets/enables the SDK’s DNS-rebinding-protection option / host header allow-list option; currently src/httpServer.ts does not set it, leaving the transport to accept requests for any Host header.
tiger-gh-mcp-server (MCP HTTP transport via httpServerFactory) DNS-rebinding-protection / DNS rebinding via Disabled Host Header Allow-List = enable host allow-list (DNS-rebinding-protection option set)
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Users running tiger-gh-mcp-server with its MCP HTTP transport locally reachable are exposed if they visit an attacker-controlled web page. The attack relies on a hostname controlled by the attacker resolving to the address on which the server is bound.
What does an attacker need to exploit it?
The attacker needs to induce a user to visit a page in their browser and use a controlled DNS name pointed at the server's bound address. No prior privileges are required, but the attack complexity is high and user interaction is required.
Are default deployments affected?
The affected code started the MCP HTTP transport without explicitly enabling the SDK's host-header allow-list. Whether a particular deployment is reachable for exploitation depends on the address to which its transport is bound and browser access to that address.
What should be changed if updating is not immediately possible?
Enable the underlying SDK's DNS-rebinding-protection or host allow-list option when creating the HTTP server. A dependency update by itself does not close the issue; the option must be passed explicitly.
How can I determine whether my source checkout is affected?
Inspect src/httpServer.ts for the call to the shared httpServerFactory helper. The vulnerable implementation does not set the DNS-rebinding-protection option; the fixed change passes that option explicitly.