DNS Rebinding Vulnerability in Tiger-Slack by Timescale

CVE-2026-81099

What is CVE-2026-81099?

The Tiger-Slack product from Timescale is vulnerable due to the improper configuration of the MCP HTTP transport, which lacks an enabled host allow-list. This oversight allows attackers to exploit the transport by redirecting requests through a browser under their control. To mitigate this issue, the transport needs to explicitly pass a DNS-rebinding-protection option as part of the server's configuration, in addition to updating dependencies. The affected boundary includes the versions released prior to the fix commit, posing a risk to users with earlier iterations of the product.

References