CVE-2026-77339: Process Compose Auth Bypass Vulnerability

CVE-2026-77339 Overview

Process Compose is a scheduler and orchestrator for non-containerized applications. CVE-2026-77339 affects the Model Context Protocol (MCP) Server-Sent Events (SSE) listener in src/mcp/server.go prior to version 1.120.0. The listener accepts browser-origin requests to /sse and the returned message endpoint without validating the Host header, validating the Origin header, or authenticating the caller. The Gin REST API token middleware does not protect this separately started MCP listener, leaving it exposed on the loopback interface. The maintainers fixed the issue in version 1.120.0 by adding a Host/Origin/auth trust boundary.

Critical Impact
When MCP SSE is enabled with expose_control_tools, a malicious website can use DNS rebinding to reach the loopback listener and start, stop, restart, or scale local processes, read or truncate logs, and invoke user-defined tools.

Affected Products

Process Compose versions prior to 1.120.0
Deployments with MCP SSE listener enabled
Configurations with expose_control_tools enabled or user-defined tools registered

Discovery Timeline

2026-09-18 - CVE CVE-2026-77339 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-77339

Vulnerability Analysis

The flaw is a missing authentication issue [CWE-306] in the MCP SSE listener. Process Compose starts the MCP listener separately from the Gin-based REST API, so the token middleware protecting the REST endpoints does not apply to /sse. The listener accepts any request from a browser origin without validating Host or Origin headers.

Because the MCP listener binds to loopback, developers may assume it is unreachable from external attackers. However, DNS rebinding attacks defeat that assumption. A malicious webpage can rebind an attacker-controlled hostname to 127.0.0.1, then issue same-origin fetches to the local MCP listener from the victim's browser.

Once a rebinding path is established, the attacker can invoke MCP tools exposed by the server. When expose_control_tools is enabled, this includes enumerating process state, reading and searching logs, truncating logs, and starting, stopping, restarting, or scaling local processes. User-defined tools may expose additional commands and command output to the attacker.

Root Cause

The MCP SSE handler in src/mcp/server.go lacked three controls: Host header validation to reject rebound hostnames, Origin header validation to reject cross-site browser requests, and authentication of the caller. The REST API token middleware runs on a different listener and never sees MCP traffic.

Attack Vector

Exploitation requires the victim to visit an attacker-controlled webpage while Process Compose runs locally with MCP SSE enabled. The attacker uses DNS rebinding to make the browser treat 127.0.0.1 as same-origin with the malicious site, then issues MCP requests to /sse and the returned message endpoint.

// Patch imports added to src/mcp/server.go in v1.120.0
import (
	"context"
	"errors"
	"fmt"
	"io"
	stdLog "log"
	"net/http"
	"sync"
	"time"

	"github.com/f1bonacc1/process-compose/src/types"
	"github.com/mark3labs/mcp-go/mcp"
)

Source: GitHub commit 6ffa74f. The patch adds net/http handling to enforce Host/Origin/auth checks on the SSE listener.

Detection Methods for CVE-2026-77339

Indicators of Compromise

Unexpected process start, stop, restart, or scale events initiated from local sessions with no corresponding user activity.
Log truncation events on Process Compose managed processes without administrator action.
SSE connections to the MCP listener with Origin or Host header values that do not match trusted local hostnames.

Detection Strategies

Inspect Process Compose logs for MCP tool invocations correlated with browser activity on developer workstations.
Monitor network telemetry for DNS responses that resolve external hostnames to 127.0.0.1 or other loopback addresses.
Alert on new outbound HTTP connections from browser processes to the MCP SSE port immediately after suspicious DNS resolutions.

Monitoring Recommendations

Enumerate hosts running Process Compose versions prior to 1.120.0 with MCP SSE enabled.
Track configuration state of expose_control_tools and any user-defined tools across development environments.
Baseline expected MCP client User-Agent, Host, and Origin values and alert on deviations.

How to Mitigate CVE-2026-77339

Immediate Actions Required

Upgrade Process Compose to version 1.120.0 or later on all systems.
Disable the MCP SSE listener where it is not required for active workflows.
Disable expose_control_tools and audit any user-defined tools that could execute local commands.

Patch Information

The fix is available in Process Compose v1.120.0. The remediation is documented in GHSA-5gm3-9crp-6g3v and implemented in commit 6ffa74f. The patch introduces a trusted_hosts configuration option and enforces Host/Origin/auth validation on the SSE listener.

Workarounds

Bind the MCP listener to a Unix domain socket or a non-loopback interface protected by firewall rules if upgrading is not immediately possible.
Configure the new trusted_hosts allowlist after upgrading to restrict which Host header values the listener accepts.
Restrict browser access on developer workstations to trusted sites while Process Compose is running with MCP SSE enabled.

bash

# Configuration example - trusted_hosts allowlist introduced in v1.120.0
# process-compose.yaml
mcp:
  enabled: true
  expose_control_tools: false
  trusted_hosts:
    - "localhost"
    - "127.0.0.1"

Source: schema change in commit 6ffa74f.