共收录 17 条相关安全情报。
← 返回所有主题The Aqara Developer Portal (developer.aqara.com) and shared test environments (developer-test.aqara.com, aiot-test.aqara.com) exhibit cross-origin request sharing, which is an instance of "CWE-942: Permissive Cross-domain Policy with Untrusted Domains," and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N (8.2 High).
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
The Aqara IAM/SSO gateway (gw-builder.aqara.com) exhibits a cross-origin request sharing vulnerability, which is an instance of "CWE-942: Permissive Cross-domain Policy with Untrusted Domains," and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N (8.2 High).
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
CORS misconfiguration in the REST API of Network Optix Nx Witness VMS before version 6.1.2, when running in the default Standard security mode, on Linux and Windows allows an unauthenticated remote attacker to steal the session token of an authenticated user and perform Administrator Account Takeover via a malicious cross-origin web page visited by the victim. The High security mode is not affecte
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, when RUSTFS_CORS_ALLOWED_ORIGINS is unset, the RustFS S3 listener's ConditionalCorsLayer reflects any request Origin value back as Access-Control-Allow-Origin and also sets Access-Control-Allow-Credentials: true and Access-Control-Allow-Headers: * on responses, including preflight responses and error responses. Thi
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we implemented `allowed-origins` and `allowed-hosts` flags to align with MCP security guidelines. However, the hardcoded `Access-Control-Allow-Origin: *` header in the SSE initialization handler was inadvertently retained. This vulnerability specifically impacts users connecting via Toolbox using SSE un
💡 风险点: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
CVE-2026-9739 是一个影响使用 Server-Sent Events (SSE) 的应用程序的 DNS 重新绑定漏洞。在产品的 beta 阶段，开发人员为了遵循 MCP 安全指南，实现了 `allowed-origins` 和 `allowed-hosts` 标志。然而，在 SSE 初始化处理程序中，硬编码的 `Access-Control-Allow-Origin: *` 标头被无意保留，导致跨域访问控制失效。攻击者可以通过 DNS 重新绑定攻击绕过同源策略，从而可能窃取敏感数据或执行未经授权的操作。该漏洞特别影响使用 Toolbox 并采用规范 v2024-11-05 进行 SSE 连接的用户。受影响的应用程序未明确指定厂商和产品名称，但根据描述，应该是某个支持 SSE 的服务（如 MCP 相关服务）。目前该漏洞尚未被列入已知利用漏洞清单（KEV），也无在野利用的证据。缓解措施包括：升级到已移除硬编码 Header 的补丁版本，或通过防火墙限制 SSE 端点的网络暴露，并严格验证 Origin 和 Host 头。
💡 影响/原因: DNS 重新绑定攻击可导致跨域请求伪造和数据泄露，尤其影响使用 SSE 的实时通信服务。硬编码的宽松 CORS 策略扩大了攻击面，需立即修复。
GitLab MCP Server lets an AI agent talk directly to GitLab. Prior to 0.6.0, the HTTP transport in src/transport.ts ships with no authentication layer at all and a wildcard Access-Control-Allow-Origin: * on every response. The structural defect is that the SSE server stands up a stateful, mutation-capable RPC endpoint that is backed by the operator's GITLAB_PERSONAL_ACCESS_TOKEN without any inbound
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server's Access-Control-Allow-Origin response header was hardcoded to the wildcard * regardless of the caller's Origin. Because EventSource does not preflight and does not send cookies, the wildcard is sufficient to let any third-party page the developer visits open a cross-origin EventSource to the SSE port and
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
### Summary The TTS generation endpoint sets `Access-Control-Allow-Origin: *` as a hardcoded response header, independent of the server's CORS configuration. This enables any webpage to make cross-origin requests to generate speech using stored credentials. ### Root Cause ```typescript // packages/server/src/controllers/text-to-speech/index.ts:83 res.setHeader('Access-Control-Allow-Origin', '*'
💡 风险点: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
### Summary The SSE event server's `Access-Control-Allow-Origin` response header was hardcoded to the wildcard `*` regardless of the caller's `Origin`. Because `EventSource` does not preflight and does not send cookies, the wildcard is sufficient to let any third-party page the developer visits open a cross-origin `EventSource` to the SSE port and read the live filename stream from JavaScript. Co
💡 风险点: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Same-origin policy bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Inappropriate implementation in CORS in Google Chrome on Linux and ChromeOS prior to 148.0.7778.168 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Insufficient policy enforcement in ViewTransitions in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, and supported download clients like qBittorrent. Prior to 2.9.10, Cleanuparr's global CORS policy reflects every request Origin and combines it with AllowCredentials(). When DisableAuthForLocalAddresses is enabled, the API also authenticates requests purely by source IP via TrustedNetworkAuthentication
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
## SSE Transport Has No Authentication and Wildcard CORS, Exposing All 86 GitLab Tools Including Destructive Operations A review of `mcp-gitlab-server` at commit `80a7b4cf3fba6b55389c0ef491a48190f7c8996a` uncovered that the SSE HTTP transport — advertised in the README and comparison table as a differentiating feature — runs with no authentication and wildcard CORS on every endpoint. The maintain
💡 风险点: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
CVE-2026-7643 影响 ChatGPTNextWeb NextChat 至 2.16.1 版本。漏洞位于 API 端点的 Next.js 文件中，由于不安全的跨域策略配置，攻击者可利用该漏洞发起远程攻击，导致与不可信域名之间的跨域权限过度宽松。攻击复杂度低，无需权限，但需要用户交互（如点击链接）。CVSS 3.1 评分为 4.3（中等）。目前漏洞利用代码已公开，但厂商尚未回应修复。建议受影响的用户立即限制相关 API 端点的网络暴露，例如通过防火墙或反向代理实施白名单控制，并监控异常跨域请求。由于无官方补丁，可考虑禁用不必要的 API 接口或升级至更新版本（如有）。
💡 影响/原因: 该漏洞利用代码已公开，攻击者可通过社会工程诱导用户触发，导致跨域绕过，增加数据泄露或中间人攻击风险。虽评分中等，但无官方修复，需主动缓解。
A security vulnerability has been detected in alexta69 MeTube up to 2026.04.09. This affects the function on_prepare of the file app/main.py of the component CORS Policy. The manipulation leads to permissive cross-domain policy with untrusted domains. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2026.04.10 is able
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估