Vulnerability · Published Sep 18, 2026 · Assigned by GitHub_M
CVE-2026-77339Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools
Medium 5.1
In plain English
A medium-severity missing authentication in process-compose from F1bonacc1. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listener in src/mcp/server.go accepts browser-origin requests to /sse and the returned message endpoint without validating the Host header, validating the Origin header, or authenticating the caller. When MCP SSE is enabled, a malicious website can use DNS rebinding to reach the loopback listener and issue MCP requests. If expose_control_tools is enabled, the attacker can enumerate process state, read or search logs, truncate logs, and start, stop, restart, or scale local processes; configured user-defined tools can expose additional commands and output. The Gin REST API token middleware does not protect this separately started MCP listener. This issue is fixed in version 1.120.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/f1bonacc1/process-compose | 1.120.0 | GHSA-5gm3-9crp-6g3v |
| Go | github.com/f1bonacc1/process-compose | 1.120.0 | GO-2026-6515 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| F1bonacc1 | process-compose | < 1.120.0 |
Weakness: CWE-306, CWE-346 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:H/SA:N