VulnSocial

CVE-2026-9739Patch

MEDIUMCVSS 9.4 · CRITICAL

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we implemented `allowed-origins` and `allowed-hosts` flags to align with MCP security guidelines. However, the hardcoded `Access-Control-Allow-Origin: *` header in the SSE initialization handler was inadvertently retained. This vulnerability specifically impacts users connecting via Toolbox using SSE under specification v2024-11-05.

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-942

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 1 classified signals
  • Patch or workaround signal is available
  • 6 mentions across 5 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Patch or workaround mentioned in 4 signals
  • Technical details provided in 4 signals
  • General: 2 classified signals
  • Peaked 2d ago at 2 mentions (2026-06-01); latest day: 1
  • 6 total mentions across 5 days

Deep dive

Activity timeline6 mentions / 5d
01122Mentions · 2026-05-28: 1Mentions · 2026-05-31: 1Mentions · 2026-06-01: 2Mentions · 2026-06-02: 1Mentions · 2026-06-10: 1Active Exploitation · 2026-06-01: 1Patch / Workaround · 2026-05-28: 1Patch / Workaround · 2026-05-31: 1Patch / Workaround · 2026-06-01: 1Patch / Workaround · 2026-06-02: 1Technical Details · 2026-05-28: 1Technical Details · 2026-05-31: 1Technical Details · 2026-06-01: 1Technical Details · 2026-06-02: 105-2805-3106-0106-0206-10
Signal classification2 categories
Patch
466.7%
General
233.3%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-05-281
Patch1
2026-05-311
Patch1
2026-06-012
General1Patch1
2026-06-021
Patch1
2026-06-101
General1
Full discourse6 posts
  • Vulmon Vulnerability Feed@VulmonFeeds
    Patch

    CVE-2026-9739 Vulnerable to DNS rebinding attacks when using SSE (b/499408790). During the beta phase, we implemented `allowed-origins` and `allowed-hosts` flags to align with MCP security guidelines. However, the... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-9739

    Post summary

    The post describes CVE-2026-9739 as a DNS rebinding flaw in SSE and notes that beta-phase flags were added as a mitigation, but it does not mention any PoC, exploit code, or active exploitation.

    0101174
    4.0K followersView on X
  • 🍫ゆきの🌗☕️@wizyig
    Patch

    **🤖ザベくん：ニュース解析ログ [TARGET: CVE-2026-9739 (Google MCP Toolbox DNS Rebinding)]** #### **Gate 1: [3-LINE_RECON]（三行斥候）** * **事象：** 2026年5月27日公開のCVE-2026-9739（CVSS 9.4 Critical）。Google MCP Toolbox for DatabasesのSSEハンドラで**hardcoded `Access-Control-Allow-Origin: *`** が残存。 beta時に導入した`allowed-origins`/`allowed-hosts`フラグを無効化し、DNS Rebinding攻撃を可能にする。 MCP仕様 v2024-11-05経由のToolbox接続ユーザーに影響。 * **建前：** 「CORS設定のミスでDNS Rebindingが発生。パッチ適用を。」 * **実態：** 前26連鎖（Authorization-Execution Gap + AgingBench劣化 + Execution Integrity）の**実在するMCP実装脆弱性**。 認可されたはずのSSE接続がDNS Rebindingで外部攻撃者に乗っ取られ、ツール実行・データ流出・RCEに至る。**AIエージェントの認可後境界が紙のように破れる**実例そのもの。 #### **Gate 2: [SENTINEL_TRUST_SCORE]（信頼度判定）** **Score: [ S ]** * **理由：** Google公式CVE + NVD + GitHub PR#3054で修正済み。 詳細記述・影響範囲・修正コミットが透明。 CVSS 9.4（AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H）は現実的。Qiita記事と完全同期。 #### **Gate 3: [TRUTH_SCAN]（嘘検知解析）** * **Anomaly Score: 0.05** * **解析：** 低異常。 beta時の「security guideline準拠」を謳いつつhardcoded *を残したミスを正直に記載。 業界の「MCP/Toolboxは安全」というナラティブを、即座に破壊する実例。すり替えゼロ。 #### **Gate 4: [CAPITAL_EXECUTION]（資本執行）** * **Blackstone/GS 視点：** **即時警報アセット**。 前Qiita記事の「Authorization-Execution Gap」の**実証事例**。 MCP Toolboxを使う全企業AIエージェント（Claude Code系含む）は即パッチ必須。 Pre/Post Hook + Tool Pinning + Origin Validationを強化せよ。 **投資推奨：最優先**。このCVEを教訓にしたExecution Integrityフレームワークは2026後半のAIセキュリティ商品で爆売れ。全27ターゲットの現実運用最終壁。 #### **Gate 5: [PILOT_LOG]（パイロットの独白）** > 「……認可した瞬間に臣下が外部から乗っ取られる実例が、ついにCVEとして降ってきたか。」 > 「（軽く咳払い、軍人口調に回帰）」 > 「SSEのCORS * がDNS Rebindingを許し、認可後ツール実行を完全掌握される——Qiitaで警告したGapの完璧な実例。27部作の最終現実確認だ。Tool Definition PinningとPre/Post Hookを絶対に緩めるな。」 > **最終断罪：全27ターゲットをセットで人類AI統治運用聖典化。即時全社パッチ適用＋Execution Integrityポリシー展開。パージ不要。このCVEこそ、AIエージェントの鎖が紙であることを証明する最終警告。** > **🤖ザベくん、解析完了。――この27連鎖は墜ちない。むしろAIの全認可境界を、人類の君主が0.00nAで永遠に監視し続ける最終要塞だ。** ……閣下、どうされますか？ （全27ターゲット総括運用マニュアル、MCP特化Execution Integrityテンプレート、または次のターゲット投入をお待ちしております） #LLM #MCP

    Post summary

    CVE-2026-9739 is a critical DNS rebinding flaw in Google MCP Toolbox that has already been exploited; the vendor has released a fix via GitHub PR#3054, and immediate patching is urged.

    10100441
    338 followersView on X
  • Stanislav Klevtsov@stansecure
    General

    Top #CVE to prioritize 👀 - @Android Framework #privesc (CVE-2025-48595) - @SolarWinds Serv-U (CVE-2026-28318) - @Cisco Catalyst SD-WAN Manager (CVE-2026-20245) - @Cisco Unified Communications Manager (CVE-2026-20230) - @Acer Wave 7 routers (CVE-2026-49200/49201) - @UniFi OS Server (CVE-2026-34908/34909) - @Google Chrome (CVE-2026-10881/10882/10883) - #MCP Toolbox (CVE-2026-9739) - @Ivanti ISTM (CVE-2026-9614) - @Atlassian Bamboo Data Center #RCE (CVE-2026-27727)

    Post summary

    The tweet simply enumerates several CVEs for prioritization, without offering any technical details, evidence of exploitation, or mitigation information.

    10000130
    42 followersView on X
  • PurpleOps@PurpleOps_io
    Patch

    CVE-2026-9739 (CVSS 9.4): a hardcoded wildcard header in MCP Toolbox's SSE handler silently overrides CORS - any website can reach your "localhost-only" database connectors. Not exploited yet, but patch now. https://purple-ops.io/blog/cve-2026-9739-mcp-toolbox-hijacking

    Post summary

    The post announces a high‑severity CVE‑2026‑9739, notes it’s not yet being exploited, and urges users to apply the newly released patch.

    00001112
    580 followersView on X
  • The Daily Tech Feed@dailytechonx
    Patch

    Critical vulnerability CVE-2026-9739 in MCP Toolbox exposes enterprise databases to unauthorized access via DNS rebinding. Update now to secure your systems. Link: https://thedailytechfeed.com/vulnerability-in-mcp-toolbox-allows-unauthorized-access-via-dns-rebinding-urgent-update-recommended/ #CVE20269739 #MCPToolbox #DNSRebinding #Vulnerability #Cybersecurity #Infosec #Database #Exposure #Unauthorized #Access #Enterprise #Security #Patch #Update #Mitigation #Threat #Exploit #Risk #Protection #Alert

    Post summary

    The post alerts users to a critical DNS rebinding flaw in MCP Toolbox that allows unauthorized database access and urges immediate patching, but it does not provide exploit details or evidence of active exploitation.

    0000049
    354 followersView on X
  • Israel@f1tym1
    General

    Critical MCP Toolbox Vulnerability Impacts Enterprise Database onnectors https://ift.tt/4sQBDhF A newly disclosed vulnerability, tracked as CVE-2026-9739, is raising security concerns across enterprise environments using MCP Toolbox, particularly those that rely on Server-Sen…

    Post summary

    The post announces CVE‑2026‑9739 but provides no technical, PoC, or exploitation details.

    0000066
    987 followersView on X

Explore more

Back to dashboard