CVE-2025-64443 is a critical (CVSS 9.6) DNS rebinding flaw in Docker MCP Gateway 0.27.0 and earlier. It applies when the gateway runs in sse or streaming transport mode. Upgrade to 0.28.0, or run the default stdio mode, which listens on no network ports.
What's affected
The GitHub advisory (GHSA-46gc-mwh4-cc5r) and the record agree. Docker MCP Gateway versions up to and including 0.27.0 are affected when started in sse or streaming mode through the transport option. Version 0.28.0 fixes it.
The default stdio mode is not affected. In that mode the gateway does not listen on any network port, so a web page cannot reach it.
The risk follows the MCP servers behind the gateway. Any tool or feature those servers expose could be manipulated, so the impact depends on what you have connected, such as file access, repositories or cloud APIs.
How to check if you're exposed
Find out how your gateway is started. Search your scripts, compose files and service definitions for the transport setting:
grep -rniE "transport" ~/.docker ./docker-compose*.yml ./*.sh 2>/dev/null
ps aux | grep -i "mcp" | grep -v grep
If you see sse or streaming, the gateway listens on a port and is in scope until you upgrade. Check the version of the gateway you installed, using the release notes or the version command your install supports, and compare it with 0.28.0. Then list the MCP servers behind it and what each one can do. An instance that fronts file system or shell tools has far higher impact than one fronting a read only search tool.
What to do now
- Upgrade Docker MCP Gateway to 0.28.0 or later.
- If you cannot upgrade, stop using sse or streaming mode and use the default stdio mode. The advisory names this as the workaround.
- Review which MCP servers run behind the gateway and drop any tool you do not need.
- Bind network listeners to localhost only, and do not publish the port to other interfaces.
- Treat browser access as part of your threat model for local developer tools. Pages you visit can try to reach services on your machine.
Why it matters
The record lists CWE-749, exposed dangerous method or function. DNS rebinding works by making a hostname first resolve to an outside address and then to a local one, so a browser treats a local service as the same origin as a hostile site. Servers that do not check the Host header or origin will answer requests that a normal cross site request could not make.
Local developer tools have often assumed that localhost is safe. MCP gateways make that assumption costly, because the servers behind them can act on files, code and cloud accounts. The record does not list the CVE as known exploited, and the advisory reports no exploitation.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is the default setup affected?
No. The advisory says the gateway is not affected in its default stdio mode, which listens on no network ports.
What is the fix?
Upgrade to 0.28.0, or avoid sse and streaming mode.
Sources
Last reviewed: 18 October 2026.
