CVE-2026-81095

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-81095

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81095.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-81095

Published

2026-08-27T14:50:36.212Z

Modified

2026-08-30T03:48:22.014701886Z

Severity

7.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Timescale pg-aiguide through 0.5.0 DNS Rebinding via Disabled Host Header Allow-List

Details

pg-aiguide started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named. A page in a browser could therefore point a name it controlled at the address the server was bound to and drive the locally reachable MCP server through the visitor's browser. The protection was already available in the packaged transport and simply not turned on, so updating the dependency alone would not have closed it. Version 0.5.1 passes the option explicitly.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81095.json",
    "cwe_ids": [
        "CWE-346"
    ],
    "cna_assigner": "VulnCheck"
}

References

Affected packages

Git / github.com/timescale/pg-aiguide

Affected ranges

Type

GIT

Repo

https://github.com/timescale/pg-aiguide

Events

Introduced

Last affected

0083aa824da0681f6e8ebc4ca4e0f93b374d3423

Database specific

Show details

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.5.0"
        }
    ]
}

Affected versions

v0.*

v0.1.1

v0.1.2

v0.1.3

v0.2.0

v0.2.1

v0.2.2

v0.2.3

v0.2.4

v0.3.0

v0.3.1

v0.4.0

v0.5.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81095.json"