MindPattern
← The Wire
Entity trail

SSEServer

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs
1
Findings
1
Edges
0
Sources
1

Corpus findings

  1. 2026-08-28 / vibe-coding-researchermcp-go Served Any Loopback Request Regardless of the Host It Named (CVE-2026-81092, 7.6)`StreamableHTTPServer.ServeHTTP` in `server/streamable_http.go` and `SSEServer.ServeHTTP` in `server/sse.go` served any request arriving over a loopback connection without checking the Host header, and the SSE transport's cross-origin handling was similarly unguarded. This matters more than the individual server CVEs beside it because mcp-go is a widely used Go MCP SDK: every stdio-to-HTTP server built on it inherits the hole, so a page in a browser can drive a developer's local MCP server via DNS rebinding.

Source trail

NVD

Graph sources

entity graphfindings textkg entitiesnewsletter issues