CVE-2026-77339

Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listener in src/mcp/server.go accepts browser-origin requests to /sse and the returned message endpoint without validating the Host header, validating the Origin header, or authenticating the caller. When MCP SSE is enabled, a malicious website can use DNS rebinding to reach the loopback listener and issue MCP requests. If expose_control_tools is enabled, the attacker can enumerate process state, read or search logs, truncate logs, and start, stop, restart, or scale local processes; configured user-defined tools can expose additional commands and output. The Gin REST API token middleware does not protect this separately started MCP listener. This issue is fixed in version 1.120.0.

• CWE-306
• CWE-346

• https://github.com/F1bonacc1/process-compose/commit/6ffa74f462cd2fa4f8dc1ee63c70b793b298c858
• https://github.com/F1bonacc1/process-compose/releases/tag/v1.120.0
• https://github.com/F1bonacc1/process-compose/security/advisories/GHSA-5gm3-9crp-6g3v
• https://github.com/F1bonacc1/process-compose/security/advisories/GHSA-5gm3-9crp-6g3v

Published

Sep 18, 2026

Last Modified

Sep 18, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-77310jackson-databind contains the general-purpose data-binding f…5.3
• CVE-2026-77317SeaweedFS is a distributed storage system for files and blob…8.1
• CVE-2026-7732A vulnerability was detected in code-projects BloodBank Mana…6.3
• CVE-2026-77322SIPGO is a library for writing SIP services in the GO langua…7.5
• CVE-2026-7733A flaw has been found in funadmin up to 7.1.0-rc6. This affe…7.3
• CVE-2026-77337CakePHP Authentication is an authentication plugin for CakeP…9.1
• CVE-2026-7734A vulnerability has been found in osrg GoBGP up to 4.3.0. Th…7.5
• CVE-2026-77341cpp-httplib is a C++ header-only HTTP/HTTPS library. In vers…5.3
• CVE-2026-77348Wallos is an open-source, self-hostable personal subscriptio…8.2
• CVE-2026-7735A vulnerability was found in osrg GoBGP up to 4.3.0. Affecte…7.3
• CVE-2026-77351Wallos is an open-source, self-hostable personal subscriptio…3.5
• CVE-2026-77352Wallos is an open-source, self-hostable personal subscriptio…4.3