DNS Rebinding Vulnerability in Timescale's tiger-gh-mcp-server

CVE-2026-81100

What is CVE-2026-81100?

The tiger-gh-mcp-server fails to properly implement host header checks when starting its MCP HTTP transport, leaving the application susceptible to DNS rebinding attacks. Without enabling the host allow-list provided by its underlying SDK, the server can be tricked into accepting requests from unauthorized hosts. This vulnerability enables an attacker to control the GitHub MCP endpoint from a malicious webpage, potentially leading to unauthorized access to sensitive data. To mitigate this risk, the application must explicitly set the DNS-rebinding-protection option along with necessary dependency updates. As of now, no official release has addressed this issue, which remains present in the commit preceding the fix.

References