# GHSA-v52w-28xh-v562: Kozou compiles a PostgreSQL schema into an Admin UI, a REST API, and an MCP server.

> Kozou MCP server lacked DNS-rebinding protection, allowing attackers to bypass loopback restrictions and execute functions or read data via browser-based attacks.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Local or same network only
- **Victim action needed:** A user has to click or open something
- **Fix available:** Yes
- **Published:** 19 Jun 2026

## What is GHSA-v52w-28xh-v562?

GHSA-v52w-28xh-v562 is a vulnerability in @kozou/api, published on 19 Jun 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

### Official description

Kozou compiles a PostgreSQL schema into an Admin UI, a REST API, and an MCP server. Several hardening gaps in the bundled HTTP surfaces and the scaffolded dev stack are fixed in **1.8.1**.

## Issues

1. **MCP HTTP server lacked DNS-rebinding protection.** The Streamable HTTP transport is unauthenticated and loopback by default. Without `Host`/`Origin` validation, a malicious web page in the operator's browser could rebind a hostname it controls to the loopback address and drive the MCP endpoint — reading schema metadata, or (when the opt-in `call` execution tool is enabled) executing exposed functions as the execution role.

2. **Unbounded request-body buffering (DoS).** Both the MCP HTTP server and the in-house REST server read the entire request body into memory with no size limit, so a reachable client could drive the process toward memory exhaustion.

3. **Read requests ran in a read/write transaction.** The shared role-transaction envelope opened every request with a plain `BEGIN`, so a `GET` ran read/write. A `SELECT` that reaches a volatile function or a writable / `INSTEAD`-triggered view could perform a write that then commits — the "a GET only reads" contract was left to the serving role's grants rather than enforced.

4. **No-auth dev surfaces published on all interfaces by default.** The scaffolded `docker-compose.yml` (and the quickstart) published the unauthenticated Admin UI and MCP HTTP server — and the default-credential demo database — on every host interface, and the config defaulted those binds to `0.0.0.0`.

## What changed in 1.8.1

- **DNS-rebinding guard (MCP HTTP):** the server validates the `Host` header (and a present `Origin`) against an allowlist before handling any request, on every route. Matching is on the hostname; loopback names are always accepted and an operator can add hosts via configuration. A browser cannot forge `Host`/`Origin`, so this closes the rebinding vector. (This is a browser-rebinding defence; network reachability of an unauthenticated server must still be constrained by the network — see workarounds.)
- **Request-body size cap:** both HTTP servers reject an over-large declared `Content-Length` (413) and enforce the limit while streaming, so a chunked / `Content-Length`-less body cannot grow unbounded. A non-JSON `Content-Type` on a body is rejected with 415. The cap is configurable.
- **Read-only read transactions:** read methods (`GET`) now run in a `READ ONLY` transaction, so the database refuses any write for the duration of the request regardless of the role's grants.
- **Loopback-by-default network posture:** the Admin UI and MCP HTTP server now bind loopback by default; the bundled compose files publish every host port (Admin UI, MCP, database) on `127.0.0.1` only, while the container binds all interfaces internally so the loopback mapping still works. Operators opt into a broader bind explicitly.

## Impact

The MCP HTTP server's exposure is greatest when the opt-in `call` execution tool is enabled and/or the server is reachable beyond loopback. The read/write-transaction issue has effect only when the schema exposes a read path that can write (a volatile-function-backed column or a writable/`INSTEAD`-triggered view) and the serving role holds write grants. The all-interface publish affected anyone who ran the scaffolded `docker compose up` on a host reachable from an untrusted network. Requests run under `SET LOCAL ROLE`, so PostgreSQL still enforces grants/RLS at runtime; these are defense-in-depth and read-contract hardening.

## Affected / patched

- npm packages `kozou`, `@kozou/api`, `@kozou/mcp`, `@kozou/core` (and the lockstep-versioned siblings): affected `<= 1.8.0`, patched **1.8.1**.
- Container image `ghcr.io/kozou-dev/kozou`: patched at tag `v1.8.1`.

## Workarounds (if you cannot upgrade immediately)

- Bind the Admin UI and MCP HTTP server to loopback and publish their host ports on `127.0.0.1` only; do not expose them to untrusted networks.
- Do not enable the MCP `call` execution tool on a non-loopback / unauthenticated deployment.
- Put an authenticating reverse proxy (with `Host`/`Origin` validation and a request-body limit) in front of any non-loopback deployment.
- Change the demo database's default credentials and restrict its port.

## Patches

Upgrade to **Kozou 1.8.1** (all npm packages and the `ghcr.io/kozou-dev/kozou` image).

## Which versions are affected by GHSA-v52w-28xh-v562?

8 open source packages ship an affected version, including @kozou/api, @kozou/core and @kozou/mcp.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `@kozou/api` | npm | All versions | 1.8.1 |
| `@kozou/api` | npm | All versions | 1.8.1 |
| `@kozou/core` | npm | All versions | 1.8.1 |
| `@kozou/core` | npm | All versions | 1.8.1 |
| `@kozou/mcp` | npm | All versions | 1.8.1 |
| `@kozou/mcp` | npm | All versions | 1.8.1 |
| `kozou` | npm | All versions | 1.8.1 |
| `kozou` | npm | All versions | 1.8.1 |

## How do I fix GHSA-v52w-28xh-v562?

Upgrade @kozou/api to 1.8.1 or later.

## Is GHSA-v52w-28xh-v562 being exploited?

There is no known exploitation of GHSA-v52w-28xh-v562 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-v52w-28xh-v562 and fix it if it is affected.

What it is: GHSA-v52w-28xh-v562 is a vulnerability in @kozou/api, published on 19 Jun 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Exploitation: There is no known exploitation of GHSA-v52w-28xh-v562 in the wild and no public exploit code.

Affected packages and fixed versions:
- @kozou/api (npm): affected all versions; fixed in 1.8.1
- @kozou/api (npm): affected all versions; fixed in 1.8.1
- @kozou/core (npm): affected all versions; fixed in 1.8.1
- @kozou/core (npm): affected all versions; fixed in 1.8.1
- @kozou/mcp (npm): affected all versions; fixed in 1.8.1
- @kozou/mcp (npm): affected all versions; fixed in 1.8.1
- kozou (npm): affected all versions; fixed in 1.8.1
- kozou (npm): affected all versions; fixed in 1.8.1

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-v52w-28xh-v562/ (Markdown: https://insights.sbomify.com/GHSA-v52w-28xh-v562/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-v52w-28xh-v562

---
From sbomify Insights: https://insights.sbomify.com/GHSA-v52w-28xh-v562/
Summaries are generated and may contain mistakes; the official description above is the record.