AI agent vulnerability · Other MCP servers and tools

CVE-2025-64443: Docker MCP Plugin and Docker MCP Gateway have DNS Rebinding vulnerability when running in sse or streaming mode

highCVSS 4.0 7.3GHSA-46gc-mwh4-cc5r

Impact When ran in sse or streaming mode (--transport), the Docker MCP Gateway is vulnerable to a DNS rebinding attack. Vulnerability allows for Browser-Based exploitation of any MCP servers that are executing within the Docker MCP Gateway.

Published Dec 3, 2025

Affected packages

github.com/docker/mcp-gateway

Ecosystem: Go
Affected: <= 0.27.0
Fixed in: 0.28.0
Check: go list -m github.com/docker/mcp-gateway

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Impact

When ran in sse or streaming mode (--transport), the Docker MCP Gateway is vulnerable to a DNS rebinding attack.

Vulnerability allows for Browser-Based exploitation of any MCP servers that are executing within the Docker MCP Gateway. Any tools or other features exposed by MCP servers can be manipulated by an attacker who is able to get a victim to visit a malicious website, or if a victim is served a malicious advertisement.

The MCP Gateway is not prone to this attack when started in its default stdio mode, which does not listen on any network ports.

Patches

Patch available in version v0.28.0

Workarounds

Do not start the MCP gateway in sse or streaming mode (use default stdio)

Credited to JLLeitschuh.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Other MCP servers and tools vulnerabilities

All Other MCP servers and tools entries