{"id":"CVE-2026-62863","published":"2026-10-30T21:17:14.547","lastModified":"2026-10-30T21:17:14.547","description":"MoLing is a computer-use and browser-use based MCP server. Prior to 0.5.0, when MoLing runs in SSE mode using `-l`, its `/sse` and `/message` HTTP endpoints do not authenticate requests and the `mcp-go` dependency sets `Access-Control-Allow-Origin: *`. A malicious web page can open a cross-origin `EventSource` to `/sse`, including a loopback listener, and read the `endpoint` event to obtain `sessionId`. After a victim running SSE mode visits that page, the attacker can use the disclosed `sessionId` against `/message` to send unauthorized MCP tool calls. Depending on the configured tools, those calls can read or write local files, execute commands or perform other actions. Binding only to loopback does not prevent this browser-mediated attack. This issue is fixed in version 0.5.0.","cvssScore":9.6,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L","cwes":["CWE-306","CWE-942"],"vendors":[],"products":[],"references":[{"url":"https://github.com/gojue/moling/commit/ae07f704cbc88d4419fc0fbaec278090fcd0502d","tags":[]},{"url":"https://github.com/gojue/moling/pull/48","tags":[]},{"url":"https://github.com/gojue/moling/releases/tag/v0.5.0","tags":[]},{"url":"https://github.com/gojue/moling/security/advisories/GHSA-qpgh-hp5g-4vwp","tags":[]}],"exploitRefs":[{"url":"https://github.com/gojue/moling/commit/ae07f704cbc88d4419fc0fbaec278090fcd0502d","tags":[]},{"url":"https://github.com/gojue/moling/pull/48","tags":[]},{"url":"https://github.com/gojue/moling/releases/tag/v0.5.0","tags":[]},{"url":"https://github.com/gojue/moling/security/advisories/GHSA-qpgh-hp5g-4vwp","tags":[]}],"hasPoc":true,"ai":{"summary":"MoLing's SSE mode exposes unauthenticated /sse and /message endpoints with permissive CORS, allowing any malicious website to hijack a victim's session via cross-origin EventSource to steal the sessionId and issue unauthorized MCP tool calls.","exploitability":"Exploitation requires the victim to visit a malicious webpage while MoLing runs in SSE mode; no special privileges or user interaction beyond visiting the page is needed.","blast_radius":"Attackers can execute arbitrary local commands, read/write files, or perform other actions based on the configured MCP tools, leading to full system compromise depending on tool permissions.","remediation":"Upgrade to MoLing version 0.5.0 or later, which fixes the authentication and CORS issues.","detection":"Defenders may observe unexpected cross-origin EventSource connections to /sse from browsers, or repeated /message requests using unfamiliar session IDs not tied to known user sessions; however, no reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","cors-misconfig","web","mcp","session-hijack"],"model":"garnet-coder","analyzedAt":"2026-10-31T08:48:33.787Z"}}