Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-08-28 · source-backed
NVD published CVE-2026-81091 through 81102 plus 81735 at 17:20 UTC on August 27, with GitHub advisories confirming same-day publication rather than backlog indexing (NVD). Eight are an HTTP transport that binds broadly or never enables the DNS-rebinding host allow-list the underlying MCP SDK already provides: pg-aiguide, tiger-slack, tiger-gh-mcp-server, Dash, mcp-go, mcp-router, Telnyx and UI-TARS-desktop. The SDKs ship the guard opt-in and server authors are uniformly not opting in, which makes this a default-selection failure rather than eight independent mistakes. If you maintain an MCP server, the fix is enabling the allow-list you already have.
Each link below shares sources, entities, or timing with this story.
PraisonAI uses MCP / Shared entities / Same source domain / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (PraisonAI uses MCP); both cover August, CVE, CVEs, DNS; reported by the same outlet (nvd.nist.gov).
MCP SDK built by Anthropic / Shared entities / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (MCP SDK built by Anthropic); both cover CVE, CVEs, HTTP, MCP; overlapping topics (cves, server).
MCP SDK built by Anthropic / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (MCP SDK built by Anthropic); both cover August, CVEs, GitHub, MCP; overlapping topics (already, august, server).
MCP uses Go SDK / Shared entities / Same source / Shared topic
Linked by a graph relationship (MCP uses Go SDK); both cover CVE, CVEs, DNS, HTTP; cite the same source (NVD).
MCP SDK built by Anthropic / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (MCP SDK built by Anthropic); both cover August, CVE, HTTP, MCP; overlapping topics (august, server).
Linked by a graph relationship (MCP SDK built by Anthropic); both cover CVE, CVEs, HTTP, MCP; overlapping topics (cves, server).
MCP SDK built by Anthropic / Shared entities / Earlier coverage
Linked by a graph relationship (MCP SDK built by Anthropic); both cover August, CVE, GitHub, MCP; earlier August coverage from 2026-08-21.
Claude Code uses MCP / Shared entities / Earlier coverage
Linked by a graph relationship (Claude Code uses MCP); both cover August, GitHub, MCP, UTC; earlier August coverage from 2026-08-17.