CVE-2026-81099
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
tiger-slack started its MCP HTTP transport without enabling the host allow-list provided by the underlying SDK. mcp/src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted requests regardless of the host name. A page in a browser could point a controlled name at the server's bound address and drive the locally reachable Slack MCP server through the visitor's browser. The fix passes the option explicitly alongside a dependency update; the update alone would not have closed it.
Risk Assessment
An attacker can use a victim's browser to remotely drive the local Slack MCP server, potentially leading to unauthorized access to data and actions in the user's context.
Recommendation
Apply the fix that explicitly enables the host allow-list in the MCP HTTP transport and update dependencies to the version containing this change.
Original NVD description (English source)
tiger-slack started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. mcp/src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, and a page in a browser could point a name it controlled at the address the server was bound to and drive the locally reachable Slack MCP server through the visitor's browser. The fix passes the option explicitly alongside a dependency update; the update alone would not have closed it. The repository publishes no release that brackets the fix, so the affected boundary is the commit preceding it.