GHSA-v52w-28xh-v562: Kozou: Unauthenticated MCP HTTP server and bundled dev-stack hardening (DNS-rebinding, request-body limits, read-only reads, default network exposure)

June 19, 2026

Kozou compiles a PostgreSQL schema into an Admin UI, a REST API, and an MCP server. Several hardening gaps in the bundled HTTP surfaces and the scaffolded dev stack are fixed in 1.8.1.

References

github.com/advisories/GHSA-v52w-28xh-v562
github.com/kozou-dev/kozou/security/advisories/GHSA-v52w-28xh-v562

Code Behaviors & Features

Detect and mitigate GHSA-v52w-28xh-v562 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →