Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/geiserx/genieacs-mcp

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.8GoAmendedPublished

    genieacs-mcp: DNS rebinding reaches local GenieACS MCP Streamable HTTP transport

    CVE-2026-55637 · GHSA-cmwv-wf9p-p8wx

    Affected
    • Go github.com/geiserx/genieacs-mcp <= 0.3.1
    Fixed in
    0.3.2· Vendor fix available
    Issue
    genieacs-mcp exposes a local Streamable HTTP MCP endpoint that accepts attacker-controlled Host and Origin headers. A malicious web page can use DNS rebinding to route browser requests to a victim's loopback MCP listener while preserving the attacker origin. The server accepts the request, initializes an MCP session, lists GenieACS tools, and can invoke tools against the configured GenieACS NBI without a browser-supplied secret. The affected package is genieacs-mcp version 0.3.1 at commit 4d7d3c74740efb7f3833aadc8a8e9177650eb462. The vulnerable transport setup is in cmd/server/main.go. When TRANSPORT is not stdio, the server creates a Streamable HTTP MCP handler: For the default loopback listener, MCPAUTHTOKEN is not required. The unauthenticated branch calls httpSrv.Start(addr) directly. There is no middleware or MCP transport configuration that validates Host or Origin before /mcp handles the request. The README documents loopback HTTP as the default deployment mode and says…

    Recommended action: Upgrade to 0.3.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)osv.dev (2)github.com (3)Source checked Evidence →