MoLing: Missing authentication and permissive CORS in SSE mode allow cross-origin session takeover
Summary
MoLing, an MCP server for computer and browser use, exposes its /sse and /message HTTP endpoints without authentication when run in SSE mode (-l), and the underlying mcp-go library sends Access-Control-Allow-Origin: *. A malicious web page visited by a user running SSE mode can read the sessionId from the SSE stream and send unauthorized MCP tool calls. Depending on the enabled tools, an attacker can read or write local files or execute commands. Binding to loopback does not prevent this browser-mediated attack.
Affected
- gojue MoLing, all versions before 0.5.0 (when run in SSE mode with -l)
Fixed in
- Fixed in version 0.5.0 (commit ae07f70). Note: the v0.5.0 release notes do not name this issue; verify against the advisory GHSA-qpgh-hp5g-4vwp.
Workaround
- Unknown. No vendor-published workaround; upgrading to 0.5.0 is the documented remedy.
Exploitation
- As of 30 October 2026, no public evidence of exploitation known to the research sources, no public exploit or proof of concept found, and not listed in CISA KEV (third-party aggregator data, not independently verified).
Our recommendation
- Identify all MoLing installations on endpoints, especially developer and AI-assistant workstations.
- Upgrade to version 0.5.0 or later and verify the fix against the vendor advisory.
- Disable SSE mode (-l) where it is not needed and stop the process when unused.
- Do not rely on loopback binding as a protection.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fix commit ae07f70 github.com
- Pull Request #48 github.com
- Release v0.5.0 github.com
- GitHub Security Advisory GHSA-qpgh-hp5g-4vwp github.com
- OffSeq Radar: CVE-2026-62863 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 22:21.
Original description (NVD)
MoLing is a computer-use and browser-use based MCP server. Prior to 0.5.0, when MoLing runs in SSE mode using `-l`, its `/sse` and `/message` HTTP endpoints do not authenticate requests and the `mcp-go` dependency sets `Access-Control-Allow-Origin: *`. A malicious web page can open a cross-origin `EventSource` to `/sse`, including a loopback listener, and read the `endpoint` event to obtain `sessionId`. After a victim running SSE mode visits that page, the attacker can use the disclosed `sessionId` against `/message` to send unauthorized MCP tool calls. Depending on the configured tools, those calls can read or write local files, execute commands or perform other actions. Binding only to loopback does not prevent this browser-mediated attack. This issue is fixed in version 0.5.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.