DNS Rebinding Vulnerability in Timescale pg-aiguide

CVE-2026-81095

What is CVE-2026-81095?

The pg-aiguide component of Timescale has a vulnerability that arises from initiating its HTTP transport without enabling the host allow-list feature provided by its underlying SDK. This oversight allows attackers to utilize a malicious browser page to craft requests directed at the MCP server. Due to the lack of DNS-rebinding protection, any specified host name in the requests can be processed by the server, potentially leading to unauthorized access. Although the necessary protective measures are built into the packaged transport, they were not activated, making it essential to update to version 0.5.1 or later where this option is explicitly set.

References