{
 "id": "AIR-2026-1220",
 "slug": "cve-2026-63118-dns-rebinding-vulnerability-in-mcp-ruby-sdk",
 "title": "CVE-2026-63118: DNS Rebinding Vulnerability in MCP Ruby SDK",
 "summary": "An HTTP Host header validation flaw in the MCP Ruby SDK allows malicious web pages to use DNS rebinding to interact with local Model Context Protocol servers. The issue was resolved in version 0.23.0.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "mcp gem"
 ],
 "incident_date": "2026-07-29",
 "incident_date_precision": "day",
 "first_reported": "2026-07-29",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63118",
   "publisher": "NVD",
   "title": "CVE-2026-63118: MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients.",
   "published_at": "2026-07-29"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-63118",
  "mcp",
  "dns-rebinding"
 ],
 "created_at": "2026-10-18T10:04:21.885Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}