Evidence · DiggingBeagle record

Windows-MCP v0.7.5 security patch: CORS and DNS rebinding

Windows-MCP release notes describing the fix for GHSA-vrxg-gm77-7q5g.

Published: May 14, 2026
Accessed: Sep 14, 2026
Publisher: CursorTouch
Source role: primary
Version: 2026-05-14
Rights: Public web source; citation and short excerpt only.

Evidence record

Version 0.7.5 removed wildcard CORS by default and added TrustedHostMiddleware-based DNS rebinding protection.

Read the original source ↗

Claim-level citations (1)

supportsWindows-MCP HTTP modes exposed PowerShell behind a weak control plane: Windows-MCP 0.7.5 removed wildcard CORS by default and added trusted-host checks intended to mitigate cross-origin and DNS-rebinding access.
Security fix