DNS Rebinding in Toolbox SSE Implementation

Publication date: 2026-05-27

Last updated on: 2026-05-27

Assigner: Google Inc.

Description

Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we implemented `allowed-origins` and `allowed-hosts` flags to align with MCP security guidelines. However, the hardcoded `Access-Control-Allow-Origin: *` header in the SSE initialization handler was inadvertently retained. This vulnerability specifically impacts users connecting via Toolbox using SSE under specification v2024-11-05.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-27

Last Modified

2026-05-27

Generated

2026-07-08

AI Q&A

2026-05-28

EPSS Evaluated

2026-07-07

NVD

CVE-2026-9739

EUVD

EUVD-2026-32672

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-942	The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.

Attack-Flow Graph

Executive Summary

This vulnerability involves DNS rebinding attacks when using Server-Sent Events (SSE). During the beta phase, security measures such as `allowed-origins` and `allowed-hosts` flags were implemented to follow security guidelines. However, a hardcoded header `Access-Control-Allow-Origin: *` remained in the SSE initialization handler, which allows any origin to access the resource. This flaw specifically affects users connecting via Toolbox using SSE under specification v2024-11-05.

Impact Analysis

This vulnerability can allow attackers to perform DNS rebinding attacks, potentially bypassing same-origin policies. This means an attacker could trick a user's browser into interacting with internal or restricted network resources via the vulnerable SSE connection, leading to unauthorized access or data exposure.

Hi! I’m here to help you understand CVE-2026-9739. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70