https://vulnerability.circl.lu/sightings/feed 2026-08-30T19:11:09.713281+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/c055abbb-d2a8-4ddc-9dd3-945ba790b8d4/export 2026-08-30T19:11:09.806820+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "c055abbb-d2a8-4ddc-9dd3-945ba790b8d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55637", "type": "seen", "source": "https://gist.github.com/alon710/f1f1abcaa50d05cc95fe39660771a422", "content": "# CVE-2026-55637: CVE-2026-55637: Remote Administrative Command Execution in genieacs-mcp via DNS Rebinding\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-08-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55637\n\n## Summary\nCVE-2026-55637 is a high-severity DNS rebinding vulnerability affecting the genieacs-mcp Model Context Protocol server. Prior to version 0.3.2, the application's Streamable HTTP transport lacks adequate Host and Origin header validation. This omission allows external attackers to bypass the Same-Origin Policy through a victim's browser and issue unauthenticated commands to loopback listeners.\n\n## TL;DR\nUnauthenticated loopback HTTP transport in genieacs-mcp prior to 0.3.2 fails to validate Host and Origin headers, enabling remote attackers to bypass the Same-Origin Policy via DNS rebinding and compromise GenieACS administration.\n\n## Technical Details\n\n- **CWE ID**: CWE-346 (Origin Validation Error)\n- **Attack Vector**: Network / Browser-Driven DNS Rebinding\n- **CVSS v4.0 Score**: 8.8 (High)\n- **Exploit Status**: Proof of Concept\n- **CISA KEV Status**: Not Listed\n- **Remediation Status**: Patched in v0.3.2\n\n## Affected Systems\n\n- genieacs-mcp\n- **genieacs-mcp**: < 0.3.2 (Fixed in: `0.3.2`)\n\n## Mitigation\n\n- Upgrade to genieacs-mcp v0.3.2 or higher.\n- Disable the HTTP network listener by setting TRANSPORT=stdio.\n- Enforce mandatory authorization across loopback interfaces by configuring MCP_AUTH_TOKEN.\n- Define strict domain restrictions using MCP_ALLOWED_HOSTS and MCP_ALLOWED_ORIGINS environment variables.\n\n**Remediation Steps:**\n1. Access the local deployment configuration files for the genieacs-mcp application.\n2. Modify the configuration or Docker-compose environment variables to update the container version to v0.3.2.\n3. If immediate upgrade is unfeasible, add TRANSPORT=stdio to the system's environment properties.\n4. Generate and configure a robust token under MCP_AUTH_TOKEN to require authenticated interactions.\n\n## References\n\n- [CVE-2026-55637 Record](https://www.cve.org/CVERecord?id=CVE-2026-55637)\n- [Official Security Advisory GHSA-cmwv-wf9p-p8wx](https://github.com/GeiserX/genieacs-mcp/security/advisories/GHSA-cmwv-wf9p-p8wx)\n- [Pull Request Addressing DNS Rebinding](https://github.com/GeiserX/genieacs-mcp/pull/26)\n- [v0.3.2 Release Tag](https://github.com/GeiserX/genieacs-mcp/releases/tag/v0.3.2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55637) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-26T12:32:44.827783Z"} 2026-08-26T12:32:44.827783+00:00 https://vulnerability.circl.lu/sighting/f6b0b245-cca0-4586-a12b-2d586f3e355a/export 2026-08-30T19:11:09.809590+00:00 Joseph Lee https://vulnerability.circl.lu/user/syspect {"uuid": "f6b0b245-cca0-4586-a12b-2d586f3e355a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-55637", "type": "published-proof-of-concept", "source": "https://github.com/GeiserX/genieacs-mcp/security/advisories/GHSA-cmwv-wf9p-p8wx", "content": "", "creation_timestamp": "2026-08-25T20:35:33.034899Z"} 2026-08-25T20:35:33.034899+00:00