DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-77339: CVE-2026-77339: Unauthenticated Remote Command Execution in Process Compose via DNS Rebinding

#security #cve #cybersecurity

CVE-2026-77339: Unauthenticated Remote Command Execution in Process Compose via DNS Rebinding

Vulnerability ID: CVE-2026-77339
CVSS Score: 5.1
Published: 2026-09-18

CVE-2026-77339 is a critical security vulnerability in Process Compose before version 1.120.0. The Model Context Protocol (MCP) Server-Sent Events (SSE) listener transport subsystem fails to validate the HTTP Host and Origin headers, and does not enforce authentication. This omissions expose local loopback listeners to DNS rebinding attacks orchestrated by malicious remote websites visited by developers, enabling unauthorized process control and arbitrary command execution.

TL;DR

Process Compose before version 1.120.0 lacks Host header, Origin header, and authentication validation on its secondary MCP SSE listener. Remote malicious websites can leverage DNS rebinding to execute arbitrary commands locally on a developer's workstation if control tools are enabled.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-306, CWE-346
  • Attack Vector: Network (Requires User Interaction & DNS Rebinding)
  • CVSS v4.0: 5.1 (Medium)
  • EPSS Score: Not yet assigned
  • Impact: Information Disclosure, Denial of Service, Remote Code Execution
  • Exploit Status: PoC / Theoretical
  • KEV Status: Not in KEV Catalog

Affected Systems

  • Process Compose prior to v1.120.0
  • process-compose: < 1.120.0 (Fixed in: 1.120.0)

Code Analysis

Commit: 6ffa74f

Implement HTTP server wrapper and security validation middleware for MCP SSE transport

Mitigation Strategies

  • Upgrade Process Compose to version v1.120.0 or later.
  • Configure global authentication tokens using the PC_API_TOKEN environment variable.
  • Restrict binding configurations to local loopback interfaces (127.0.0.1).
  • Disable the expose_control_tools parameter in configurations when not in use.

Remediation Steps:

  1. Verify the version of Process Compose currently deployed in the local development environment.
  2. Obtain and install binary version 1.120.0 or newer from the official release page.
  3. Set up the PC_API_TOKEN system environment variable with a strong, randomly generated string.
  4. Modify the process-compose.yaml file to ensure trusted_hosts is not configured to allow wildcard values.

References

Read the full report for CVE-2026-77339 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)