CVE-2026-81099: Origin Validation Error in timescale tiger-slack

The tiger-slack component of timescale started its MCP HTTP transport without enabling the host allow-list feature provided by the underlying SDK. Specifically, the mcp/src/httpServer.ts file called the shared httpServerFactory helper but did not set the DNS-rebinding-protection option. This omission allowed the transport to accept requests regardless of the host header, enabling an attacker to direct a browser to a hostname they control that resolves to the server's bound address. This could allow the attacker to drive the locally reachable Slack MCP server through the victim's browser. The fix involved explicitly passing the DNS-rebinding-protection option along with a dependency update. The repository does not publish a release version that includes this fix, so all versions before the fixing commit are affected.

An attacker can exploit this vulnerability to perform DNS rebinding attacks, potentially causing a victim's browser to interact with the local Slack MCP server in unintended ways. This could lead to unauthorized actions or information disclosure via the victim's browser. The CVSS 4.0 score of 7.6 reflects high severity with network attack vector, low attack complexity, and required user interaction with partial attack and impact complexity.

Patch status is not yet confirmed as no official release includes the fix. The fix requires explicitly setting the DNS-rebinding-protection option in the MCP HTTP transport code and updating dependencies. Users should monitor the vendor repository for an official release containing this fix and apply it promptly once available. Until then, consider mitigating DNS rebinding risks through network controls or browser security settings where feasible.