CVE-2026-35577

CVE-2026-35577 is a host header validation vulnerability affecting Apollo MCP Server versions prior to 1.7.0. The flaw exists in the StreamableHTTP transport implementation, where missing Host header validation could allow attackers to bypass same-origin policy restrictions through DNS rebinding techniques and invoke GraphQL operations or access exposed resources on behalf of local users. The vulnerability carries a CVSS 3.1 score of 8.1 (HIGH) with a network-based attack vector, low complexity, no privilege requirements, and user interaction needed. Successful exploitation could result in high confidentiality and integrity impact. The practical risk is substantially mitigated in deployments utilizing authentication mechanisms, network-level access controls, or non-localhost bindings, and does not affect stdio-based transport modes. There is currently no evidence of active exploitation in the wild. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities (KEV) catalog and is not listed on active threat intelligence hotlists. The EPSS score of 0.00019 indicates minimal probability of near-term exploitation relative to the broader CVE landscape. Organizations should update to version 1.7.0 as a preventive measure, with priority based on whether instances are publicly accessible or lack additional security controls.