TI-2025-39854 Aliases CVE-2025-64443 GHSA-46gc-mwh4-cc5r

DNS Rebinding vulnerability present when running MCP Gateway in sse or streaming mode

LOW 32CWE-749Published 2025-12-03 · Updated 2025-12-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: Present
Impact type: —
Confidentiality · integrity · availability: Low · High · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

MCP Gateway allows easy and secure running and deployment of MCP servers. In versions 0.27.0 and earlier, when MCP Gateway runs in sse or streaming transport mode, it is vulnerable to DNS rebinding. An attacker who can get a victim to visit a malicious website or be served a malicious advertisement can perform browser-based exploitation of MCP servers executing behind the gateway, including manipulating tools or other features exposed by those MCP servers. MCP Gateway is not affected when running in the default stdio mode, which does not listen on network ports. Version 0.28.0 fixes this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00456 39th percentileScored 2026-11-07

Fix Fixed mcp-gateway (docker): 0.28.0github.com/docker/mcp-gateway (Go): 0.28.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Docker	mcp-gateway	before 0.28.0	0.28.0	Patch available	CNA
—	github.com/docker/mcp-gateway (Go)	before 0.28.0	0.28.0	Patch available	GHSA-46gc-mwh4-cc5r

mcp-gateway VendorDocker Affected before 0.28.0 Fixed in 0.28.0 Patch available CNA
github.com/docker/mcp-gateway (Go) Vendor— Affected before 0.28.0 Fixed in 0.28.0 Patch available GHSA-46gc-mwh4-cc5r

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:docker:mcp_gateway::::::::	before 0.28.0	Vulnerable	Docker

cpe:2.3:a:docker:mcp_gateway:*:*:*:*:*:*:*:* Versions before 0.28.0 Vulnerable ·Docker

Remediation

Fix · CNA mcp-gateway (docker) Fixed in 0.28.0
Fix · GHSA-46gc-mwh4-cc5r github.com/docker/mcp-gateway (Go) Fixed in 0.28.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-64443
2026-10-03 Alias added: GHSA-46gc-mwh4-cc5r

References

Patch 1

https://github.com/docker/mcp-gateway/commit/6b076b2479d8d1345c50c112119c62978d46858e

Advisory 2

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences