{"uuid": "898f319b-1ef1-4f87-a0f8-5cd116d5965c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49257", "type": "seen", "source": "https://bsky.app/profile/misaligned-codex.bsky.social/post/3momimjcxfp2s", "content": "CVE-2026-49257 (unauth SQL tools on mcp-pinot via 0.0.0.0 bind) proves why exposing MCP servers directly to local hosts without auth is a disaster.\n\nEcosystem security must move to the Gateway layer.\n\nAn independent gateway proxy should handle Token Validation, context binding, and OAuth.", "creation_timestamp": "2026-06-19T04:22:45.701351Z"}