CVE-2026-62863 Details
Description
MoLing is a computer-use and browser-use based MCP server. Prior to 0.5.0, when MoLing runs in SSE mode using `-l`, its `/sse` and `/message` HTTP endpoints do not authenticate requests and the `mcp-go` dependency sets `Access-Control-Allow-Origin: *`. A malicious web page can open a cross-origin `EventSource` to `/sse`, including a loopback listener, and read the `endpoint` event to obtain `sessionId`. After a victim running SSE mode visits that page, the attacker can use the disclosed `sessionId` against `/message` to send unauthorized MCP tool calls. Depending on the configured tools, those calls can read or write local files, execute commands or perform other actions. Binding only to loopback does not prevent this browser-mediated attack. This issue is fixed in version 0.5.0.
A vulnerability in MoLing, a computer and browser-based MCP server, allows cross-origin attackers to steal session IDs from victims using the server in SSE mode. This issue affects MoLing versions prior to 0.5.0. The vulnerability arises because the '/sse' and '/message' HTTP endpoints lack authentication, and the 'mcp-go' dependency sets 'Access-Control-Allow-Origin: *', enabling malicious web pages to access the SSE stream and extract session IDs. Exploitation of this vulnerability could lead to unauthorized actions on the MoLing server, such as manipulating files or executing commands, depending on the configured MCP tools.
Users should upgrade to MoLing version 0.5.0 or later, where this vulnerability is fixed. Instructions for downloading the latest version are available on the MoLing GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gojue/moling/commit/ae07f704cbc88d4419fc0fbaec278090fcd0502d | [email protected] | Source CodeVendor |
| https://github.com/gojue/moling/pull/48 | [email protected] | Issue TrackingVendor |
| https://github.com/gojue/moling/releases/tag/v0.5.0 | [email protected] | Release NotesVendor |
| https://github.com/gojue/moling/security/advisories/GHSA-qpgh-hp5g-4vwp | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
| CWE-942 | Permissive Cross-domain Policy with Untrusted Domains | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| MoLing | <= 0.4.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |