CircleCI MCP server RCE: a header check the attacker can already forge
Remedio broke into CircleCI's MCP server with zero credentials: the Host/Origin allowlist is defense theater, since clients set both headers themselves. Send Host: localhost with no Origin and both checks pass, then call run_pipeline to execute arbitrary code under the org's token. That's unauthenticated RCE against build secrets and cloud identities — pending CVE, likely CVSS 10.0.