Executive brief
tiger-slack is an MCP server and Slack ingest tool for connecting Slack to agentic workflows. The HTTP transport for the MCP service was deployed without DNS rebinding protection, allowing an attacker to craft a malicious web page that, when visited by a user with access to the local MCP server, could bypass network isolation and interact with the server as if the request came directly from an authorized host.
Technical details
The vulnerability is a DNS rebinding attack in the MCP HTTP transport layer. The httpServer.ts component called the shared httpServerFactory helper but failed to set the dnsRebindingProtection configuration option that the underlying SDK provides. This allowed the transport to accept requests regardless of the Host header value. An attacker could register a domain name, point it to a local network address (127.0.0.1 or the server's bound address), and embed it in a webpage; when a victim with access to the local MCP server visited the attacker's page, their browser would send cross-origin requests to the locally-reachable server. The fix requires explicitly setting dnsRebindingProtection: true alongside a dependency update; the SDK update alone was insufficient. No releases bracket the vulnerable code, making all versions prior to the fix commit affected.
Affected products
- TimescaleDB tiger-slack all versions prior to DNS rebinding protection fix commit
Timeline
- 2026-08-27: disclosed
- 2026-06-26: patched: Fix merged in PR #146