CVE-2026-81100 timescale CVE debrief

Who should care

Defenders responsible for tiger-gh-mcp-server deployments, especially those with publicly accessible GitHub MCP endpoints, should assess exposure and apply the fix or update. They should review inventory to identify potentially affected systems and prioritize verifying exposure of tiger-gh-mcp-server deployments.

Why it matters

CVE-2026-81100 allows driving locally reachable GitHub MCP endpoint from visitor's browser due to missing host allow-list in tiger-gh-mcp-server MCP HTTP transport. Defenders should verify exposure, apply the fix or update, and review inventory to identify potentially affected systems.

• Verify exposure of tiger-gh-mcp-server deployments with publicly accessible GitHub MCP endpoints.
• Apply the fix or update to prevent driving the locally reachable GitHub MCP endpoint from a visitor's browser.
• Review inventory to identify potentially affected systems.

Technical summary

The tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list provided by the underlying SDK. This made the locally reachable GitHub MCP endpoint drivable from a page in a visitor's browser that pointed a name it controlled at the bound address. The fix passes the DNS-rebinding-protection option explicitly alongside a dependency update. The repository has published no release that brackets the fix, so the affected boundary is the commit preceding it. Defenders should prioritize verifying exposure of tiger-gh-mcp-server deployments, especially those with publicly accessible GitHub MCP endpoints.

Defensive priority

Defenders should prioritize verifying exposure of tiger-gh-mcp-server deployments, especially those with publicly accessible GitHub MCP endpoints, and apply the fix from the referenced commit or update.

Recommended defensive actions

• Verify exposure of tiger-gh-mcp-server deployments, especially those with publicly accessible GitHub MCP endpoints.
• Apply the fix from the referenced commit or update.
• Review and update inventory to identify potentially affected systems.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including the affected code and fix. However, the exact scope of affected deployments and versions requires further verification. The tiger-gh-mcp-server repository has published no release that brackets the fix, so the affected boundary is the commit preceding it. Defenders should verify exposure of tiger-gh-mcp-server deployments, especially those with publicly accessible GitHub MCP endpoints.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.