VulnCheck publishes twelve CVEs against MCP HTTP transports in one batch, from mcp-go to Dropbox Dash

VulnCheck published twelve CVE records against MCP HTTP transports on 2026-08-27, all timestamped within the same minute. The batch spans unrelated projects from single-maintainer tools to Dropbox, ByteDance, Telnyx, Timescale and Apify, and the defects sort into four classes that recur across it.

The largest class is DNS rebinding through absent or disabled Host-header validation. mark3labs/mcp-go (CVE-2026-81092, 6.8 medium), the most widely used community Go SDK, accepted requests on its streamable HTTP and SSE transports without checking the Host header; version 0.56.0 fixes it. Dropbox's Dash MCP server (CVE-2026-81102) bound to loopback but never checked the host a request named, fixed by PR #12. Three Timescale servers - pg-aiguide, tiger-slack, and tiger-gh-mcp-server (CVE-2026-81095, -81099, -81100) - all called a shared helper that never enabled the host allow-list their underlying SDK provides; the records name no fixed versions.

The second class is unauthenticated listeners on every interface. The Telnyx MCP server (CVE-2026-81098, 9.1 critical) served MCP on the root path with no caller credential; the record covers versions through 6.83.0 and names no fixed version, while the telnyx-node line has moved to 7.17.0. ByteDance's UI-TARS-desktop (CVE-2026-81735) carries the batch's only CVSS 10.0: its @agent-infra MCP servers defaulted their listen address to every interface, exposing arbitrary command execution; a merged commit fixes it. mcp-router's CLI (CVE-2026-81094) is fixed in 0.6.3.

The remainder: server-side request forgery in mcp-use's inspector proxy (CVE-2026-81091, 8.6 high, no fixed version named) and in Apify's get-html-skeleton tool (CVE-2026-81093, fixed in actors-mcp-server 0.9.12 - the second record against that server this month), plus an unauthenticated Python sandbox escape in Harvard's ToolUniverse (CVE-2026-81096, no fixed version named).

Two of the affected servers are catalog entities here: telnyx-mcp and apify-mcp-server. The exposure the batch returns to again and again is one shape: a local MCP HTTP transport reachable by any process on the machine or, through DNS rebinding, by any web page in the user's browser.