CVE-2026-62863: MoLing: unauthenticated SSE enables browser-based tool calls

CRITICAL

Published October 30, 2026

CISO Take

MoLing, an MCP server that gives AI agents computer-use and browser-use tools, has a critical flaw (CVSS 9.6) in its SSE mode (`-l`). The `/sse` and `/message` endpoints require no authentication and the `mcp-go` dependency sends `Access-Control-Allow-Origin: *`. Any web page the user visits can therefore read the MCP session ID and send tool calls, including file read/write and command execution, depending on which tools are configured. Binding to loopback does not help, because the victim's own browser makes the request. No public exploit, Nuclei template, KEV listing or EPSS score exists yet, but the attack is low complexity and needs only one page visit. Upgrade to MoLing 0.5.0 now, stop running SSE mode on workstations that browse the web, and inventory developer machines that run local MCP servers.

Sources:NVDGitHub AdvisoryATLASgojue/moling GitHub

What is the risk?

High to critical. The attack is network-reachable, needs no privileges and low complexity, and needs only one user interaction (visiting a page). Scope is changed because a web page crosses into local system control. Impact depends on the enabled MoLing tools, but file access and command execution put confidentiality and integrity at high risk. No exploitation in the wild, KEV listing or public PoC is known, and EPSS is unavailable. Exposure is limited to users who run SSE mode, since the default stdio mode is not affected per the advisory. Cross-origin MCP attacks are easy to automate, so exploitation likelihood should be treated as rising.

How does the attack unfold?

Initial Access

Victim running MoLing in SSE mode visits a malicious web page that opens a cross-origin EventSource to the local /sse endpoint.

AML.T0078

Session Hijack

The page reads the `endpoint` event and extracts the sessionId, since no authentication is required and CORS allows any origin.

AML.T0049

Tool Invocation

The attacker POSTs unauthorized MCP tool calls to /message to read or write files and run commands.

AML.T0053

Impact

Credentials and source code are exfiltrated and the workstation is compromised for further lateral movement.

AML.T0112.000

Initial Access

Victim running MoLing in SSE mode visits a malicious web page that opens a cross-origin EventSource to the local /sse endpoint.

AML.T0078

Session Hijack

The page reads the `endpoint` event and extracts the sessionId, since no authentication is required and CORS allows any origin.

AML.T0049

Tool Invocation

The attacker POSTs unauthorized MCP tool calls to /message to read or write files and run commands.

AML.T0053

Impact

Credentials and source code are exfiltrated and the workstation is compromised for further lateral movement.

AML.T0112.000

How severe is it?

CVSS 3.1

9.6 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 24% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SChanged

CHigh

IHigh

ALow

What should I do?

1 step

1) Upgrade MoLing to 0.5.0 or later (commit ae07f704, PR #48). 2) Until patched, do not run MoLing with -l; use stdio transport. 3) Disable or restrict high-risk tools (shell execution, file write) in the MoLing configuration. 4) Run MCP servers in a sandbox or container with minimal filesystem access, and use a separate browser profile for agent work. 5) Detection: look for processes listening on the MoLing SSE port, requests to /sse and /message with unexpected Origin or Referer headers, and unusual child processes or file access from the MoLing process. 6) Add local MCP servers to the endpoint software inventory and review GHSA-qpgh-hp5g-4vwp.

How is it classified?

Auth BypassCode ExecutionData LeakageAgentPluginAPIAML.T0049- Exploit Public-Facing Application AML.T0053- AI Agent Tool Invocation AML.T0078- Drive-by Compromise AML.T0085.001- AI Agent Tools AML.T0112.000- Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responding to previously unknown risks

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-62863?

Is CVE-2026-62863 actively exploited?

No confirmed active exploitation of CVE-2026-62863 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-62863?

1) Upgrade MoLing to 0.5.0 or later (commit ae07f704, PR #48). 2) Until patched, do not run MoLing with `-l`; use stdio transport. 3) Disable or restrict high-risk tools (shell execution, file write) in the MoLing configuration. 4) Run MCP servers in a sandbox or container with minimal filesystem access, and use a separate browser profile for agent work. 5) Detection: look for processes listening on the MoLing SSE port, requests to `/sse` and `/message` with unexpected Origin or Referer headers, and unusual child processes or file access from the MoLing process. 6) Add local MCP servers to the endpoint software inventory and review GHSA-qpgh-hp5g-4vwp.

What systems are affected by CVE-2026-62863?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP servers, computer-use agents, browser-use agents, developer workstations.

What is the CVSS score for CVE-2026-62863?

CVE-2026-62863 has a CVSS v3.1 base score of 9.6 (CRITICAL). The EPSS exploitation probability is 0.31%.

What is the AI security impact?

Affected AI Architectures

agent frameworksMCP serverscomputer-use agentsbrowser-use agentsdeveloper workstations

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0053AI Agent Tool Invocation

AML.T0078Drive-by Compromise

AML.T0085.001AI Agent Tools

AML.T0112.000Local AI Agent

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

MoLing is a computer-use and browser-use based MCP server. Prior to 0.5.0, when MoLing runs in SSE mode using `-l`, its `/sse` and `/message` HTTP endpoints do not authenticate requests and the `mcp-go` dependency sets `Access-Control-Allow-Origin: *`. A malicious web page can open a cross-origin `EventSource` to `/sse`, including a loopback listener, and read the `endpoint` event to obtain `sessionId`. After a victim running SSE mode visits that page, the attacker can use the disclosed `sessionId` against `/message` to send unauthorized MCP tool calls. Depending on the configured tools, those calls can read or write local files, execute commands or perform other actions. Binding only to loopback does not prevent this browser-mediated attack. This issue is fixed in version 0.5.0.

Exploitation Scenario

An attacker hosts or compromises a web page, or buys an ad, and lures a developer who has MoLing running in SSE mode. The page's JavaScript opens a cross-origin EventSource to http://127.0.0.1:<port>/sse and reads the `endpoint` event to obtain the sessionId. Because CORS allows any origin, the script then POSTs MCP `tools/call` requests to `/message`, listing tools and reading ~/.ssh and cloud credential files. It then writes a payload or runs a command to establish persistence and exfiltrate the data. The victim sees nothing unusual.

Weaknesses (CWE)

CWE-306Missing Authentication for Critical FunctionPrimary CWE-942Permissive Cross-domain Security Policy with Untrusted DomainsPrimary CWE-306Missing Authentication for Critical Function CWE-942Permissive Cross-domain Security Policy with Untrusted Domains

CWE-306 — Missing Authentication for Critical Function: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

[Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.