Answer in brief
CVE-2026-81099 records a Unknown severity vulnerability in Timescale tiger-slack DNS Rebinding via Disabled Host Header Allow-List. The current sources do not mark it as known exploited. The current feed maps timescale/tiger-slack (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps timescale/tiger-slack (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| timescale/tiger-slackgeneric | >=0 <23faf7ee7e7f73e5ea4f67e627c1aca94bba1f09 | 23faf7ee7e7f73e5ea4f67e627c1aca94bba1f09 |
Published upstream
Aug 27, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 27, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 27, 2026
tiger-slack started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. mcp/src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, and a page in a browser could point a name it controlled at the address the server was bound to and drive the locally reachable Slack MCP server through the visitor's browser. The fix passes the option explicitly alongside a dependency update; the update alone would not have closed it. The repository publishes no release that brackets the fix, so the affected boundary is the commit preceding it.
Quoted source text, attributed separately from HOL analysis.