CVE-2026-107292 is an origin validation error in pydantic-ai affecting versions from 1.34.0 up to but not including 2.30.0. The vulnerability allows DNS rebinding attacks via the Host header in the Agent.to_web() and clai web chat server, enabling a malicious website to interact with a loopback-hosted agent as a same-origin service. This can lead to unauthorized execution of agent tools with local process privileges, causing data disclosure and unwanted side effects. The issue is fixed in versions 1.107.5 and 2.30.0.
Rojo's 'rojo serve' HTTP API, which listens on the default port 34872, lacks validation of the Host and Origin headers. This vulnerability allows DNS rebinding attacks where a malicious webpage can access all project source code, write malicious files to disk, and execute local programs via opener::open() without additional user interaction beyond visiting the page. The vulnerability affects versions from 0 up to but not including 7.7.0. It has a high severity with a CVSS score of 8.1.
`@zereight/mcp-gitlab` versions prior to 2.1.30 have a critical vulnerability where the Streamable HTTP MCP endpoint lacks an effective Host or Origin allowlist. This allows DNS rebinding attacks to bypass HTTP boundary checks, enabling malicious web pages to interact with a victim's local MCP listener using attacker-controlled headers. Version 2.1.30 includes a patch that addresses this issue.
ContextForge is an AI gateway, registry, and proxy that provides centralized discovery, guardrails, and management for MCP, A2A, and REST or gRPC APIs. Prior to 1.0.3, the /admin/gateways/test call site in mcpgateway/admin.py calls validate_gateway_test_url() in mcpgateway/common/validators.py to resolve and reject private, loopback, link-local, and cloud-metadata addresses, but ResilientHttpClient later resolves the original hostname again without binding the validated address. When MCPGATEWAY_ADMIN_API_ENABLED is enabled, an attacker with a database-backed role containing explicit gateways.read permission can use DNS rebinding to return a public address during validation and a private or metadata address during connection, bypassing ssrf_blocked_networks and ssrf_dns_fail_closed because those controls apply only to the validation-time result. The endpoint's allow_admin_bypass=False setting means a bootstrap-only virtual platform-admin identity without a database role is not sufficient. Successful exploitation can reach internal services and cloud metadata, expose cloud credentials, access internal APIs, or probe internal network ports. This issue is fixed in version 1.0.3.
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, ToolsMCPServer.run_sse and launch_tools_mcp_server bind to 0.0.0.0 and create /sse and /messages/ routes without invoking the available SecurityConfig authentication, origin-validation, or DNS-rebinding controls. Any reachable client can list and invoke registered tools, and a browser can target a local instance through DNS rebinding, with impact determined by the registered file, shell, and code-execution tools. This vulnerability is fixed in praisonaiagents 1.6.59.
CVE-2026-55526 is a vulnerability in MervinPraison's PraisonAI multi-agent teams system. Prior to version 1.6.58, the function spider_tools._host_is_blocked() does not properly resolve hostnames before fetching pages, allowing specially crafted hostnames like 127.0.0.1.nip.io to bypass validation and access internal HTTP services. This reliance on reverse DNS resolution for security-critical actions can lead to unauthorized internal network access. The issue is fixed in PraisonAI version 1.6.58 by using socket.getaddrinfo and failing closed on DNS errors.
BunkerWeb is an open-source, next-generation Web Application Firewall. Prior to 1.6.13, the blacklist, greylist, and antibot modules in src/common/core/blacklist/blacklist.lua, src/common/core/greylist/greylist.lua, and src/common/core/antibot/antibot.lua trust PTR suffix matches in IGNORE_RDNS, GREYLIST_RDNS, and ANTIBOT_IGNORE_RDNS without using get_ips to confirm that the hostname resolves to the client address. An unauthenticated remote attacker who controls a PTR record can spoof a trusted suffix to bypass rDNS-based blacklisting, gain greylist treatment, or skip an antibot challenge. This issue is fixed in version 1.6.13.
MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not validate the HTTP Host or Origin request headers, which allows a malicious browser page to use DNS rebinding to reach a locally running MCP server and invoke exposed tools. This issue is fixed in version 0.23.0.
CVE-2026-55391 is a high-severity vulnerability in koxudaxi datamodel-code-generator versions prior to 0.63.0. The tool improperly relies on reverse DNS resolution for security-critical decisions, allowing DNS rebinding attacks to bypass network restrictions and potentially access internal services. This issue is fixed in version 0.63.0.
Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s, implemented in glances/server.py) does not validate the HTTP Host header, leaving it vulnerable to DNS rebinding attacks. An attacker can exploit DNS rebinding to exfiltrate the full system monitoring dataset from a victim's browser. This vulnerability is fixed in 4.5.5.
CVE-2026-42559 is a high-severity vulnerability in the modelcontextprotocol Rust SDK (rmcp crate) prior to version 1.4.0. The Streamable HTTP server transport did not validate the incoming Host header, enabling a DNS rebinding attack. This flaw could allow a malicious website to send authenticated requests to an MCP server running on a victim's loopback or private network interface. The vulnerability is fixed in version 1.4.0. No known exploits in the wild have been reported.
Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.
Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration functionality allows bypassing of SSRF protections through DNS rebinding attacks. Malicious administrators could exploit this to access internal services that should be restricted. Version 9.2.0 contains a patch for the issue.
The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization bypass via reverse DNS (PTR record) spoofing on the 'checkWithoutToken' function in all versions up to, and including, 6.71. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated. Note: This is only exploitable on sites with an invalid API key.
AgentAPI is an HTTP API for Claude Code, Goose, Aider, Gemini, Amp, and Codex. Versions 0.3.3 and below are susceptible to a client-side DNS rebinding attack when hosted over plain HTTP on localhost. An attacker can gain access to the /messages endpoint served by the Agent API. This allows for the unauthorized exfiltration of sensitive user data, specifically local message history, which can include secret keys, file system contents, and intellectual property the user was working on locally. This issue is fixed in version 0.4.0.
vet is an open source software supply chain security tool. Versions 1.12.4 and below are vulnerable to a DNS rebinding attack due to lack of HTTP Host and Origin header validation. Data from the vet scan sqlite3 database may be exposed to remote attackers when vet is used as an MCP server in SSE mode with default ports through the sqlite3 query MCP tool. This issue is fixed in version 1.12.5.