pg-aiguide failed to enable the host header allow‑list in its MCP HTTP transport, meaning any incoming HTTP request is accepted regardless of the Host header value. A malicious web page can place a domain the attacker controls to resolve to the IP address of the machine running the pg‑aiguide service. When a victim’s browser loads that page, the browser’s requests are routed to the local MCP server, allowing the attacker to issue arbitrary commands via the browser’s HTTP connection. This effectively gives the attacker remote access to the MCP server on the victim’s internal network, allowing code execution or configuration changes.

The vulnerability is present in Timescale’s pg‑aiguide component versions up to and including 0.5.0. The fix was added in release 0.5.1, which enables the DNS‑rebinding protection option by default. Any deployment of pg‑aiguide 0.5.0 or earlier that exposes the MCP HTTP transport to external traffic is affected.

The CVSS score of 7.6 reflects the high impact of remote server compromise. Although the EPSS score is currently unavailable, the existence of a straightforward DNS‑rebinding attack vector—requiring only a malicious web page that the victim visits—renders exploitation plausible. The vulnerability is not listed in CISA’s KEV catalog, but the lack of host‑header validation (CWE‑346) is a known configuration flaw that can be abused easily by attackers familiar with local network services. Until the fix is applied, any system exposing pg‑aiguide’s MCP HTTP server to outside users remains at significant risk.