Insecure Request Handling in MoLing MCP Server Prior to Version 0.5.0

CVE-2026-62863

What is CVE-2026-62863?

The MoLing MCP server, before version 0.5.0, suffers from a vulnerability in which its /sse and /message HTTP endpoints do not authenticate requests while running in SSE mode with the -l option. This lack of authentication combined with a CORS configuration that allows any origin poses a significant risk. Attackers can exploit this flaw by creating a malicious web page that opens a cross-origin EventSource to the vulnerable endpoints. When a user visits the compromised page, the attacker can capture the sessionId from the endpoint event and use it to send unauthorized calls to the /message endpoint. These unauthorized calls may permit an attacker to read or write files, execute commands, or trigger other unauthorized actions on the victim's machine, showcasing a severe security oversight. This vulnerability has been addressed in version 0.5.0.

References