CVE-2026-11624: Model Context Protocol DNS Rebinding Flaw

CVE-2026-11624 Overview

CVE-2026-11624 affects the Model Context Protocol (MCP) implementation in the googleapis/mcp-toolbox project. Before the v0.25.0 release, the server did not provide a mechanism to validate the host component of incoming origins. This gap exposes MCP servers to DNS rebinding attacks, where a malicious site can interact with a locally bound MCP service across origin boundaries. The weakness is categorized as Origin Validation Error [CWE-346].

Critical Impact
An attacker-controlled web page can pivot through a victim's browser to reach a local MCP server, achieving full read and write access to the tools and data the server exposes.

Affected Products

googleapis/mcp-toolbox releases prior to v0.25.0
MCP server deployments relying on default --allowed-origins=* configuration
MCP server deployments without the --allowed-hosts flag available pre-v0.25.0

Discovery Timeline

2026-06-13 - CVE-2026-11624 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-11624

Vulnerability Analysis

The Model Context Protocol exposes tool and data interfaces over local HTTP transports. The protocol specification advises servers to validate the Origin header on inbound connections. The googleapis/mcp-toolbox server implemented an --allowed-origins flag but never enforced the host portion of the request, leaving DNS rebinding as a viable cross-origin path.

DNS rebinding lets a remote attacker bind an attacker-controlled hostname to a victim's loopback or RFC1918 address after the initial DNS lookup. The browser then treats subsequent requests as same-origin with the attacker's page. Without host validation, the MCP server accepts these forged requests and executes registered tool calls on behalf of the attacker. Because tools in MCP frequently invoke databases, shell commands, or cloud APIs, the impact extends to confidentiality, integrity, and availability of downstream systems.

Root Cause

The root cause is insufficient origin validation [CWE-346]. The pre-v0.25.0 server accepted requests whose Host header pointed to attacker-controlled domains that resolved to the local server address. No allowlist enforcement existed for the host value, and the default --allowed-origins=* setting suppressed any origin check that did exist.

Attack Vector

Exploitation requires user interaction: the victim must visit an attacker-controlled web page while an MCP server is running locally. The attacker's page uses DNS rebinding to redirect the victim's browser to the local MCP endpoint, then issues JSON-RPC calls to invoke MCP tools. See the GitHub Issue #3113 and the corresponding GitHub Pull Request #2254 for the technical write-up and the host validation fix.

Detection Methods for CVE-2026-11624

Indicators of Compromise

MCP server access logs containing Host header values that do not match localhost, 127.0.0.1, or the configured deployment hostname
Startup log entries warning that --allowed-origins or --allowed-hosts is set to *
Unexpected MCP tool invocations correlated in time with browser activity on workstations running the server

Detection Strategies

Inspect MCP server request logs for inbound Origin headers referencing external domains paired with loopback Host values
Hunt for outbound DNS queries from workstations resolving short-TTL records to 127.0.0.1 or RFC1918 ranges, a hallmark of DNS rebinding
Compare the running mcp-toolbox version against v0.25.0 across developer workstations and CI runners

Monitoring Recommendations

Enable verbose request logging on the MCP server and forward logs to a centralized analytics platform
Alert on any MCP tool execution that occurs without an associated authenticated client session
Monitor process telemetry for mcp-toolbox child processes that spawn unexpected shells, database clients, or network utilities

How to Mitigate CVE-2026-11624

Immediate Actions Required

Upgrade googleapis/mcp-toolbox to v0.25.0 or later on every host running the server
Set --allowed-hosts to an explicit list such as localhost,127.0.0.1 and remove the * wildcard
Set --allowed-origins to the specific origins permitted to reach the server
Restart MCP servers and confirm the startup warning about wildcard configuration no longer appears

Patch Information

The fix landed in v0.25.0 of googleapis/mcp-toolbox, which introduces the --allowed-hosts flag and emits a startup warning when either --allowed-hosts or --allowed-origins is set to *. Review the merged change in GitHub Pull Request #2254.

Workarounds

Bind the MCP server to a Unix domain socket instead of a TCP port where the runtime supports it
Place the MCP server behind a reverse proxy that enforces strict Host and Origin header allowlists
Restrict outbound network access from the workstation so DNS rebinding cannot resolve attacker domains to loopback

bash

# Configuration example
mcp-toolbox serve \
  --allowed-hosts "localhost,127.0.0.1" \
  --allowed-origins "https://ide.example.internal"