CVE-2025-9611: Microsoft Playwright MCP Server CSRF Flaw

CVE-2025-9611 Overview

CVE-2025-9611 affects Microsoft Playwright Model Context Protocol (MCP) Server versions prior to 0.0.40. The server fails to validate the Origin header on incoming connections. This omission allows an attacker to perform a Domain Name System (DNS) rebinding attack through a victim's web browser. By rebinding a malicious domain to the loopback interface, the attacker can send unauthorized requests to a locally running MCP server. Successful exploitation results in unintended invocation of MCP tool endpoints exposed by Playwright. The flaw is categorized under [CWE-749: Exposed Dangerous Method or Function].

Critical Impact

An attacker who lures a victim to a malicious web page can invoke MCP tool endpoints on the victim's locally bound Playwright MCP server, leading to browser automation abuse and integrity impact on the host.

Affected Products

• Microsoft Playwright MCP Server versions prior to 0.0.40
• Local developer environments running the Playwright MCP server bound to localhost
• AI agent toolchains that integrate Playwright MCP for browser automation

Discovery Timeline

• 2026-01-07 - CVE-2025-9611 published to the National Vulnerability Database (NVD)
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-9611

Vulnerability Analysis

The Playwright MCP Server exposes tool endpoints over an HTTP transport intended for local use. Without Origin header validation, the server accepts requests originating from arbitrary web contexts. An attacker hosts a page on a domain they control and instructs the victim's browser to make requests to that domain. Once the page loads, the attacker's DNS server rebinds the domain to 127.0.0.1, the address the MCP server listens on. The browser, still treating the origin as same-site, issues authenticated requests to the local MCP server. The server processes those requests because it does not check the Origin header against an allowlist of trusted hosts.

Root Cause

The root cause is missing host and origin validation in the MCP HTTP transport layer. The configuration surface did not provide an allowed-hosts mechanism, so requests arriving with attacker-controlled Host and Origin headers were processed identically to legitimate local requests. This violates the security model of loopback-bound services, which assume the browser same-origin policy isolates them from remote attackers.

Attack Vector

Exploitation requires user interaction. A victim must visit an attacker-controlled web page while the Playwright MCP server is running locally. The attack proceeds over the network through the victim's browser. Once the DNS rebinding completes, the attacker invokes any MCP tool endpoint, including browser navigation, screenshot capture, and script execution primitives exposed by Playwright.

// Security patch in packages/playwright/src/mcp/browser/config.ts
 type ViewportSize = { width: number; height: number };
 
 export type CLIOptions = {
+  allowedHosts?: string[];
   allowedOrigins?: string[];
   blockedOrigins?: string[];
   blockServiceWorkers?: boolean;

Source: GitHub Commit 1313fbd

The patch introduces an allowedHosts configuration option. The accompanying type definition documents its purpose as DNS rebinding protection rather than Cross-Origin Resource Sharing (CORS):

// Security patch in packages/playwright/src/mcp/config.d.ts
      * The host to bind the server to. Default is localhost. Use 0.0.0.0 to bind to all interfaces.
      */
     host?: string;
+
+    /**
+     * The hosts this server is allowed to serve from. Defaults to the host server is bound to.
+     * This is not for CORS, but rather for the DNS rebinding protection.
+     */
+    allowedHosts?: string[];
   },

Source: GitHub Commit 1313fbd

Detection Methods for CVE-2025-9611

Indicators of Compromise

• Inbound HTTP requests to the Playwright MCP listener with Host headers that do not match localhost or 127.0.0.1
• MCP tool invocations originating from browser sessions that were not initiated by the developer or agent runtime
• Unexpected outbound browser automation activity such as navigation, screenshots, or script evaluation initiated through the MCP endpoint

Detection Strategies

• Inspect MCP server logs for requests where the Origin header references an external domain rather than a trusted local context
• Correlate developer workstation process telemetry showing the Playwright MCP process accepting connections while a browser is rendering an untrusted site
• Hunt for short-TTL DNS responses resolving external hostnames to 127.0.0.1 or RFC1918 addresses on developer endpoints

Monitoring Recommendations

• Enable verbose request logging on the Playwright MCP server to capture Host, Origin, and Referer headers for each connection
• Alert on any process binding to MCP ports while running a Playwright version below 0.0.40
• Track DNS resolutions on engineering endpoints for rebinding patterns where a single domain returns both public and loopback addresses

How to Mitigate CVE-2025-9611

Immediate Actions Required

• Upgrade Microsoft Playwright MCP Server to version 0.0.40 or later on all developer workstations and CI runners
• Configure the allowedHosts option introduced in the patch to restrict accepted Host header values
• Stop running the Playwright MCP server while browsing untrusted web content until the upgrade is applied

Patch Information

Microsoft released the fix in Playwright commit 1313fbd, which adds an allowedHosts configuration field to the MCP transport. The patch enforces validation of the inbound Host header against the configured allowlist, blocking requests delivered through DNS rebinding. Review the GitHub Security Advisory GHSA-8rgw-6xp9-2fg3 and the VulnCheck Advisory on DNS Rebinding for additional technical context.

Workarounds

• Bind the MCP server exclusively to 127.0.0.1 and block external DNS lookups from resolving to loopback using local host firewall rules
• Run the Playwright MCP server only during active automation sessions and terminate the process when finished
• Use a reverse proxy in front of the MCP server that enforces Host header validation against a static allowlist

# Configuration example: restrict Playwright MCP to validated hosts after upgrading to 0.0.40
npx @playwright/mcp@latest \
  --host 127.0.0.1 \
  --port 8931 \
  --allowed-hosts 127.0.0.1,localhost