CVE-2026-81095: Origin Validation Error in timescale pg-aiguide

The vulnerability in pg-aiguide versions up to 0.5.0 is due to the MCP HTTP transport starting without the host allow-list enabled. Specifically, the src/httpServer.ts file calls a shared httpServerFactory helper but does not set the DNS-rebinding-protection option. As a result, the transport accepts requests regardless of the host name, allowing a page in a browser to point a name it controls at the server's bound address and interact with the locally reachable MCP server via the visitor's browser. Although the underlying SDK supports this protection, it was not enabled by default. Version 0.5.1 addresses this by explicitly passing the DNS-rebinding-protection option.

An attacker can exploit this vulnerability to perform DNS rebinding attacks, potentially causing a victim's browser to send requests to the locally reachable MCP server with an attacker-controlled host name. This could lead to unauthorized interactions with the server through the victim's browser. The CVSS 4.0 score of 7.6 reflects high impact due to network attack vector, low attack complexity, partial attack traceability, and high impact on confidentiality and integrity.

Upgrade pg-aiguide to version 0.5.1 or later, which explicitly enables the DNS-rebinding-protection option in the MCP HTTP transport. Simply updating the underlying SDK or dependencies without enabling this option will not mitigate the vulnerability. No other mitigations are indicated by the vendor advisory.