F1bonacc1 process-compose vulnerabilities

Latest F1bonacc1 process-compose CVEs

Newest publication first

1. CVE-2026-77339 Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools

   Published 2026-09-18

   Medium·CVSS 5.1 EPSS 0.26%

   Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listener in src/mcp/server.go accepts browser-origin requests to /sse and the returned message endpoint without validating the Host header, validating the Origin head...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.