CVE-2026-62863criticalCode execution2026-10-30

CVE-2026-62863: any web page can drive the MoLing computer-use MCP server in SSE mode, upgrade to 0.5.0

MoLing, a computer-use and browser-use MCP server, doesn't authenticate its /sse and /message endpoints in SSE mode before 0.5.0, and its mcp-go dependency sends Access-Control-Allow-Origin: *. A malicious web page you visit can grab a session id and send MCP tool calls that read or write files or run commands, even when MoLing only listens on loopback.

01.

What it is

When MoLing runs in SSE mode (-l), the /sse and /message HTTP endpoints accept requests without authentication (CWE-306), and the mcp-go dependency sets Access-Control-Allow-Origin: *.

A malicious page can open a cross-origin EventSource to /sse, including on a loopback listener, and read the endpoint event to learn the sessionId.

With that sessionId the page can post to /message and make unauthorized MCP tool calls. Depending on the configured tools, those can read or write local files or execute commands.

Binding only to loopback doesn't stop this, because the requests come from the victim's own browser.

02.

How to check

Check whether you run MoLing and which version (anything before 0.5.0 is affected).
Check whether you start it in SSE mode with -l. Stdio mode isn't described as affected.

03.

How to fix

Upgrade MoLing to 0.5.0 or later.
Until then, don't run MoLing in SSE mode, or stop it whenever you browse the web.

04.

Sources

More advisories for this tool