CVE-2026-81095 Timescale pg-aiguide through 0.5.0 DNS Rebinding via Disabled Host Header Allow-List
Attackers can bypass host header restrictions to access local MCP servers via DNS rebinding, requiring a patch to enable built-in protections.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-81095?
CVE-2026-81095 is a high-severity server-side request forgery vulnerability in timescale pg-aiguide, published on 27 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
pg-aiguide started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named. A page in a browser could therefore point a name it controlled at the address the server was bound to and drive the locally reachable MCP server through the visitor's browser. The protection was already available in the packaged transport and simply not turned on, so updating the dependency alone would not have closed it. Version 0.5.1 passes the option explicitly.
Weakness: CWE-346
Which versions are affected by CVE-2026-81095?
How do I fix CVE-2026-81095?
No fix has been published for CVE-2026-81095 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-81095 being exploited?
There is no known exploitation of CVE-2026-81095 in the wild and no public exploit code.
Sources
Also known as GHSA-x76c-qpjv-crcp.