CVE-2025-64443 DNS Rebinding vulnerability present when running MCP Gateway in sse or streaming mode
Attacker can exploit DNS rebinding in SSE or streaming modes to manipulate MCP servers behind the gateway.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-64443?
CVE-2025-64443 is a high-severity server-side request forgery vulnerability in docker mcp-gateway, published on 3 Dec 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
MCP Gateway allows easy and secure running and deployment of MCP servers. In versions 0.27.0 and earlier, when MCP Gateway runs in sse or streaming transport mode, it is vulnerable to DNS rebinding. An attacker who can get a victim to visit a malicious website or be served a malicious advertisement can perform browser-based exploitation of MCP servers executing behind the gateway, including manipulating tools or other features exposed by those MCP servers. MCP Gateway is not affected when running in the default stdio mode, which does not listen on network ports. Version 0.28.0 fixes this issue.
Weakness: CWE-749
Which versions are affected by CVE-2025-64443?
3 open source packages ship an affected version, including github.com/docker/mcp-gateway. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/docker/mcp-gateway Go | All versions | 0.28.0 |
github.com/docker/mcp-gateway Go | All versions | 0.28.0 |
github.com/docker/mcp-gateway Go | All versions | 0.28.0 |
Products include Docker Mcp Gateway.
How do I fix CVE-2025-64443?
Upgrade github.com/docker/mcp-gateway to 0.28.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-64443 being exploited?
There is no known exploitation of CVE-2025-64443 in the wild and no public exploit code.
Sources
Also known as GHSA-46gc-mwh4-cc5r, GO-2025-4179.