-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is a DNS rebinding attack in the Docker MCP Gateway when it's configured to run in sse or streaming mode. In these modes, the gateway starts an HTTP server to listen for client connections. The root cause of the vulnerability is that these HTTP servers did not have any authentication mechanism. A malicious website visited by a user could use DNS rebinding to make requests to the locally running gateway, bypassing the browser's same-origin policy and gaining control over the MCP servers managed by the gateway.
The analysis of the patch commit fe073985c8eb6e0c9317d2f198c07686f70ea06d confirms this. The patch introduces an authentication middleware (authenticationMiddleware) that enforces Bearer token authentication for all endpoints except /health. The startSseServer and startStreamingServer functions in pkg/gateway/transport.go were modified to apply this middleware to their HTTP handlers. These two functions are therefore identified as the core of the vulnerability, as they were responsible for creating the insecure servers. The Run function in pkg/gateway/run.go is the orchestrator that, based on the configuration, decides to call these vulnerable functions, making it a key part of the exploitation path.
gateway.Gateway.Runpkg/gateway/run.go
gateway.Gateway.startSseServerpkg/gateway/transport.go
gateway.Gateway.startStreamingServerpkg/gateway/transport.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/docker/mcp-gateway | go | <= 0.27.0 | 0.28.0 |