CVE-2026-62863: MoLing, a computer-use and browser-use Model Context Protocol (MCP) server, accepts unauthenticated tool calls that a malicious web page can send in Server-Sent Events (SSE) mode
The National Vulnerability Database (NVD) record says that before 0.5.0, MoLing's SSE-mode endpoints do not authenticate requests, so a malicious web page a user visits can obtain a session identifier and send unauthorized MCP tool calls that, depending on the configured tools, can read or write local files or execute commands; fixed in 0.5.0.
The record
- Kind
- Vulnerability
- Source record
- CVE-2026-62863: MoLing is a computer-use and browser-use based MCP server. Prior to 0.5.0, when MoLing runs in SSE mode using (National Vulnerability Database record)
- Record published
- 2026-10-30
- Posted here
- 2026-10-31
- World
- Software agents · Enterprise work agents
- Controls concerned
- Authority binding C-A2; Containment and isolation C-E5
- Checked
- Checked against its record on 2026-10-31 by a reader who did not draft it; report
verification/reports/SIG-2026-10-31-002-2026-10-31.md.
A signal's controls are the ones its record points at, the exposure; a case's controls are the ones its records show were absent or failed, so the two can differ.
What a signal is. A signal records what a primary record says; it assigns no fault. It is lighter than a case: one dated item from one record, tagged with the world, sector and controls it touches. It becomes a case when it meets the bar for one.
New signals like this, once a week. A short email when a case, signal or rule touches software agents. Free; unsubscribe in one click.
Get the weekly emailNewer: CVE-2026-61789: DBHub, a database Model Context Protocol (MCP) server, lets SQL that hides a write behind a double dash pass its read-only check on MySQL and MariaDB
Older: CVE-2026-119050: Agno PandasTools lets prompt injection make the agent call arbitrary pandas functions, including reading pickle files for code execution