# CVE-2026-81095: pg-aiguide DNS rebinding vulnerability in MCP HTTP transport

Source: https://junglewise.ai/threats/cve-2026-81095-pg-aiguide-dns-rebinding-vulnerability-in-mcp-http-transport  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-81095 · Severity: medium · CVSS 6.8 · Published 2026-08-27

pg-aiguide is a PostgreSQL assistant tool that exposes a local MCP (Model Context Protocol) HTTP server for AI coding assistants. The vulnerability allows an attacker to make a victim's browser send requests to the local server through DNS rebinding, bypassing the host validation protections that should prevent this attack. This could enable unauthorized access to the PostgreSQL server's capabilities through the victim's authenticated session.

Vendors: [Timescale](https://junglewise.ai/threats/vendors/timescale).

## Quick answers

**Is CVE-2026-81095 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81095 being exploited in the wild.

**How severe is CVE-2026-81095?** Medium severity, with a CVSS score of 6.8, published 27 August 2026.

**Which products and versions are affected?** Timescale Pg-Aiguide before 0.5.1.

**Is there a fix for CVE-2026-81095?** A patch was published on 2026-06-26: Fixed in version 0.5.1 via PR #121 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-81095 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-81095?** Check whether you run Timescale Pg-Aiguide at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a DNS rebinding attack in the MCP HTTP transport implementation. The src/httpServer.ts file failed to enable the dnsRebindingProtection option when calling the httpServerFactory helper from the underlying @tigerdata/mcp-boilerplate SDK, which left the server vulnerable to host header spoofing. An attacker could craft a malicious webpage that uses DNS rebinding techniques to make the victim's browser reach the locally-bound MCP server with an arbitrary Host header, bypassing origin validation. The protection mechanism was available in the SDK but simply not enabled in the application configuration. The fix was to explicitly set dnsRebindingProtection: !isProduction in the httpServer.ts configuration, which was released in version 0.5.1.

## Affected products

- Timescale pg-aiguide before 0.5.1

## Timeline

- 2026-08-27: disclosed
- 2026-06-26: patched: Fixed in version 0.5.1 via PR #121

## References

- [https://github.com/timescale/pg-aiguide](https://github.com/timescale/pg-aiguide)
- [https://github.com/timescale/pg-aiguide/pull/121](https://github.com/timescale/pg-aiguide/pull/121)