Threat
NVD-CVE-2026-62863
Publication date unknown · Discovered nist.gov
Page published
Publication date unknown · First observed: 3 Nov 2026
Coverage timeline
Single-source advisory — one report is available.
Why it matters
MoLing's SSE vulnerability exposes local MCP capabilities to malicious webpages despite loopback-only binding, making upgrades important wherever configured tools can access files or execute commands.
CVE-2026-62863 affects MoLing MCP server versions before 0.5.0 running in SSE mode: unauthenticated endpoints and permissive CORS allow a malicious webpage to obtain a session ID and issue unauthorized MCP tool calls. Depending on configured tools, attackers can read or write local files or execute commands, even when the server listens only on loopback. Version 0.5.0 fixes the vulnerability.