Loading vulnerability…
CVE-2026-9739 is a DNS rebinding vulnerability in Google APIs MCP Toolbox affecting deployments that use Server-Sent Events (SSE), specifically under specification v2024-11-05. The flaw is caused by a hardcoded Access-Control-Allow-Origin: * response header in the SSE initialization handler. Although allowed-origins and allowed-hosts controls were introduced during beta to enforce MCP security guidance, the retained wildcard CORS header in the SSE path overrode those intended restrictions. As a result, attacker-controlled web origins can interact with the vulnerable SSE endpoint in scenarios where DNS rebinding causes a victim browser to target internal or local MCP Toolbox services.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
Access-Control-Allow-Origin behavior from the SSE initialization handler and enforces strict origin validation through the intended global middleware and administrator-defined allowed-origins and allowed-hosts settings. Audit deployments using SSE under specification v2024-11-05, verify that exposed SSE endpoints no longer emit permissive wildcard CORS headers, and confirm that only explicitly trusted origins are permitted.No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A DNS rebinding vulnerability in MCP Toolbox's SSE implementation caused by an overly permissive CORS policy that sets Access-Control-Allow-Origin to a wildcard, enabling unauthorized access to internal/backend services and enterprise database connectors.
A critical vulnerability in MCP Toolbox caused by a hardcoded wildcard access-control header in the Server-Sent Events handler, allowing malicious websites to bypass CORS protections and connect to the local server, enabling session hijacking, arbitrary tool execution on behalf of users, proxy abuse, and possible data exfiltration from connected databases.
A DNS rebinding vulnerability in Google MCP Toolbox SSE handling caused by a retained hardcoded `Access-Control-Allow-Origin: *` header, impacting users connecting via Toolbox using SSE under specification v2024-11-05.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.