Executive brief
Kozou is a PostgreSQL compilation tool that generates admin interfaces and APIs. The product contained multiple security gaps: unauthenticated HTTP services exposed by default to all network interfaces, lack of request-size limits enabling denial-of-service attacks, and improper transaction handling allowing unintended database writes via GET requests. A malicious website could also exploit DNS rebinding to attack the local MCP server.
Technical details
Kozou's MCP HTTP server lacked DNS-rebinding protection and Host/Origin validation, allowing a malicious web page to rebind a hostname to the loopback address and read schema metadata or execute functions. Both the MCP HTTP server and REST server unboundedly buffered request bodies into memory, enabling denial-of-service via memory exhaustion. Read requests ran in read/write transactions using plain BEGIN statements, so GET requests could perform writes when the schema exposed volatile functions or writable views. The scaffolded Docker Compose configuration and default settings published unauthenticated Admin UI, MCP HTTP server, and demo database on all host interfaces (0.0.0.0) by default. Fixes in version 1.8.1 include Host/Origin validation, configurable request-body size limits, READ ONLY transaction enforcement for GET requests, and loopback-only default binding.
Affected products
- Kozou kozou <= 1.8.0
- Kozou @kozou/api <= 1.8.0
- Kozou @kozou/mcp <= 1.8.0
- Kozou @kozou/core <= 1.8.0
Timeline
- 2026-06-19: disclosed
- 2026-06-19: patched: Version 1.8.1 released with all hardening fixes