Vibe Coding
Eleven MCP Server CVEs Published in a Single 17:20 UTC Batch, Eight of Them the Same Bug
NVD published eleven MCP-server CVEs within thirty seconds of each other at 17:20 UTC on 2026-08-27 (CVE-2026-81091 through 81102, plus 81735), and GitHub advisories confirm same-day publication at 18:32 UTC rather than backlog indexing. Eight are the identical defect: an HTTP transport that binds broadly or never enables the DNS-rebinding host allow-list the underlying MCP SDK already provides (pg-aiguide, tiger-slack, tiger-gh-mcp-server, Dash, mcp-go, mcp-router, Telnyx, UI-TARS-desktop). The SDKs ship the guard opt-in, and server authors are uniformly not opting in.
Source
↳ Follow the thread