Local Transport Vulnerability in Uni-CLI by OLO
CVE-2026-58497

8.6HIGH

Key Information:

Vendor

Olo-dot-io

Status
Uni-cli
Vendor
CVE Published:
23 October 2026

What is CVE-2026-58497?

A vulnerability was discovered in Uni-CLI prior to version 0.225.2, where the legacy JSON-RPC-over-HTTP transport was exposed on loopback without validating browser Origin headers. This allowed malicious web pages to send CORS simple POST requests to the local /mcp endpoint. When initiated by an end user, these requests could potentially manipulate local Uni-CLI server tools. Version 0.225.2 addresses this issue by enforcing necessary security checks, thus closing the gap that existed between the two HTTP transport methods.

Affected Version(s)

Uni-CLI < 0.225.2

References

https://github.com/olo-dot-io/Uni-CLI/security/advisories...
x_refsource_CONFIRM
https://github.com/olo-dot-io/Uni-CLI/releases/tag/v0.225.2
x_refsource_MISC

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.