Executive brief
Process Compose is a tool that manages local application processes and exposes control interfaces via HTTP. A malicious website can use DNS rebinding to bypass security checks and send authenticated commands to a developer's local Process Compose instance, allowing the attacker to enumerate processes, read logs, and start/stop applications without authentication. This affects developers who have the MCP SSE feature enabled on their systems.
Technical details
The vulnerability is a DNS rebinding attack against the MCP SSE (Server-Sent Events) transport in Process Compose. The SSE listener (src/mcp/server.go:203-214) does not perform Host header validation, Origin header validation, or caller-secret verification before dispatching MCP requests. The vulnerable path accepts browser-origin requests directly and forwards them to MCP tools including process control handlers (start, stop, restart, scale, log read/truncate). An attacker hosting a malicious website can trigger DNS rebinding to resolve attacker.example to 127.0.0.1, allowing the browser to send crafted SSE requests with forged Host and Origin headers to the local listener. The SSE endpoint returns Access-Control-Allow-Origin: * without authentication, enabling tool enumeration and invocation. No bearer token, API key, or CSRF token is required. When expose_control_tools is enabled, the attacker gains process enumeration, log access, and process lifecycle control capabilities.
Affected products
- F1bonacc1 Process Compose up to commit d56aa59df04b72f8644811ac581a051bec05e485
Timeline
- 2026-09-18: disclosed