{
 "id": "AIR-2026-1023",
 "slug": "apollo-mcp-server-host-header-validation-vulnerability",
 "title": "Apollo MCP Server Host Header Validation Vulnerability",
 "summary": "Apollo MCP Server fails to validate the Host header on incoming HTTP requests when using StreamableHTTP transport. This could allow malicious websites to issue requests to the local server via DNS rebinding techniques.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Apollo MCP Server"
 ],
 "incident_date": "2026-04-09",
 "incident_date_precision": "day",
 "first_reported": "2026-04-09",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35577",
   "publisher": "NVD",
   "title": "CVE-2026-35577: Apollo MCP Server is a Model Context Protocol server that exposes GraphQL operations as MCP tools.",
   "published_at": "2026-04-09"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-35577",
  "dns-rebinding",
  "mcp"
 ],
 "created_at": "2026-10-18T10:04:21.885Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}