What is CVE-2025-64443?

CVE-2025-64443 is a critical-severity vulnerability in Docker Mcp-Gateway, classified under CWE-749. CVSS score: 9.6/10. Published 2025-12-03.

How severe is CVE-2025-64443?

Critical severity. CVSS v3 base score is 9.6 out of 10.

Vulnerability in Docker Mcp-Gateway

CVE-2025-64443

MCP Gateway allows easy and secure running and deployment of MCP servers. In versions 0.27.0 and earlier, when MCP Gateway runs in sse or streaming transport mode, it is vulnerable to DNS rebinding. An attacker who can get a victim to visit a malicious website or be served a malicious advertisement can perform browser-based exploitation of MCP servers executing behind the gateway, including manipulating tools or other features exposed by those MCP servers. MCP Gateway is not affected when running in the default stdio mode, which does not listen on network ports. Version 0.28.0 fixes this issue.

EPSS: 0.004 (32.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.6 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.

Affected products

Docker Mcp-gateway — versions < 0.28.0
Docker Mcp_gateway

Weakness classification (CWE)

CWE-749

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2025-64443?: CVE-2025-64443 is a critical-severity vulnerability in Docker Mcp-Gateway, classified under CWE-749. CVSS score: 9.6/10. Published 2025-12-03.
How severe is CVE-2025-64443?: Critical severity. CVSS v3 base score is 9.6 out of 10.