CVE-2026-77339 in Process Compose
Summary
by MITRE • 09/18/2026
Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listener in src/mcp/server.go accepts browser-origin requests to /sse and the returned message endpoint without validating the Host header, validating the Origin header, or authenticating the caller. When MCP SSE is enabled, a malicious website can use DNS rebinding to reach the loopback listener and issue MCP requests. If expose_control_tools is enabled, the attacker can enumerate process state, read or search logs, truncate logs, and start, stop, restart, or scale local processes; configured user-defined tools can expose additional commands and output. The Gin REST API token middleware does not protect this separately started MCP listener. This issue is fixed in version 1.120.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
Process Compose functions as a scheduler and orchestrator designed for managing non-containerized applications, providing developers with tools to control local processes through various interfaces including an HTTP-based Server-Sent Events (SSE) listener. In versions prior to 1.120.0, this MCP SSE listener implemented in the server component contains a critical authentication and authorization flaw that allows unauthenticated access from web browsers under specific network conditions. The vulnerability stems from the lack of validation on the Host header and Origin header within incoming HTTP requests directed at the /sse endpoint and its associated message delivery path. Furthermore, there is no mechanism to authenticate the caller before processing these requests, creating a significant gap in security controls for this specific service component despite other parts of the application potentially having robust protection mechanisms.
The operational impact of this vulnerability is severe due to the potential for Cross-Site Request Forgery (CSRF) attacks facilitated by DNS rebinding techniques. A malicious website can exploit browser trust relationships and network configuration nuances to make requests appear as if they originate from localhost, thereby bypassing same-origin policies that would normally restrict such interactions. When an attacker successfully executes a DNS rebinding attack against the loopback listener where Process Compose is running, they gain the ability to issue arbitrary MCP commands without any form of user interaction or consent beyond visiting the malicious page. This effectively allows remote code execution capabilities within the context of the process that started Process Compose, as the orchestrator has direct control over local system processes and log files.
The severity of the exploitation is significantly amplified when the expose_control_tools configuration option is enabled on the server. In this state, an attacker who gains access to the MCP SSE endpoint can enumerate the current state of all managed processes, effectively mapping out the running environment. They possess the ability to read or search through log files which may contain sensitive information such as API keys, database credentials, or internal application logic details. Additionally, attackers can truncate logs to cover their tracks or manipulate process lifecycles by starting, stopping, restarting, or scaling local processes. If user-defined tools are configured within Process Compose, the attack surface expands further, potentially exposing additional system commands and outputs that were not originally intended for external exposure.
This vulnerability is classified under CWE-287 Improper Authentication as the core issue lies in the failure to verify the identity of the caller before granting access to sensitive administrative functions. It also aligns with CWE-346 Origin Validation Error because the application fails to properly validate the origin or host headers, allowing requests from unauthorized sources that spoof localhost addresses. From a threat modeling perspective using MITRE ATT&CK, this vulnerability facilitates techniques such as T1078 Valid Accounts if credentials are stolen via log reading, and more critically supports lateral movement and privilege escalation within the local environment by manipulating running processes. The lack of protection for the MCP listener contrasts sharply with the Gin REST API token middleware which secures other endpoints, highlighting an inconsistent application security posture where one component lacks the safeguards present in others.
To mitigate this vulnerability, organizations must upgrade to version 1.120.0 or later where these authentication and validation checks have been implemented. Until upgrading is possible, administrators should disable the MCP SSE listener if it is not strictly required for their workflow, thereby removing the attack vector entirely. If the service must remain active, implementing strict network-level controls such as firewall rules to restrict access to localhost interfaces from external networks can provide a layer of defense in depth. Additionally, ensuring that expose_control_tools remains disabled unless absolutely necessary reduces the potential impact of any successful exploitation by limiting the scope of actions an attacker can perform on local processes and logs. Regular security audits should also be conducted to ensure consistency across all API endpoints regarding authentication requirements.