CVE-2026-81100 in tiger-gh-mcp-server
Summary
by MITRE • 08/27/2026
tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, making the locally reachable GitHub MCP endpoint drivable from a page in a visitor's browser that pointed a name it controlled at the bound address. The fix passes the option explicitly alongside a dependency update; the update alone would not have closed it. The repository has published no release that brackets the fix, so the affected boundary is the commit preceding it.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified in tiger-gh-mcp-server stems from an improper configuration of the HTTP transport layer within its Model Context Protocol implementation. Specifically, the server initializes its MCP HTTP transport without enabling the host allow-list feature provided by the underlying SDK. This oversight occurs because the src/httpServer.ts module invokes the shared httpServerFactory helper function but fails to pass or set the DNS-rebinding-protection option. Consequently, the service does not validate the Host header of incoming requests against a predefined list of allowed domains. This configuration error effectively disables critical defense mechanisms designed to prevent HTTP host header attacks and DNS rebinding exploits, leaving the endpoint exposed to unauthorized access vectors that rely on manipulating hostname resolution or request headers.
From an operational perspective, this misconfiguration allows any client with network connectivity to interact with the locally reachable GitHub MCP endpoint regardless of the origin domain specified in the request. An attacker can exploit this by crafting a malicious web page hosted on a controlled domain that directs requests to the server's bound address. Since the server does not enforce host restrictions, it processes these requests as legitimate, potentially exposing sensitive internal data or allowing unauthorized execution of commands through the MCP interface. This scenario aligns with CWE-15 External Control of Critical State Variable and is closely related to ATT&CK technique T1078 Valid Accounts if authentication was also bypassed via this vector, though primarily it represents a failure in access control enforcement for network services. The impact includes potential data exfiltration, unauthorized API calls to GitHub services using the server's credentials or context, and broader compromise of systems that trust the local MCP endpoint.
The remediation strategy involves explicitly passing the DNS-rebinding-protection option alongside other configuration parameters when initializing the HTTP server factory. It is crucial to note that a dependency update alone would not have resolved this issue; the code change was necessary to enforce the security controls provided by the updated library. The fix ensures that only requests originating from trusted, pre-approved hosts are processed, thereby neutralizing DNS rebinding and host header manipulation attacks. Organizations using affected versions must apply this specific configuration patch immediately. Since no official release version has been published yet containing this fix, users should identify the commit preceding the vulnerability disclosure as the last known safe state or manually integrate the code changes into their local builds to restore proper security posture.