CVE-2026-55637: genieacs-mcp DNS Rebinding Auth Bypass

CVE-2026-55637 Overview

genieacs-mcp is a Model Context Protocol (MCP) server for GenieACS written in Go. Versions prior to 0.3.2 expose an unauthenticated /mcp HTTP listener on the default MCP_LISTEN_ADDR of 127.0.0.1:8080 when MCP_AUTH_TOKEN is unset. The Streamable HTTP transport in cmd/server/main.go does not validate the Host or Origin headers, enabling DNS rebinding attacks from a malicious website against the loopback listener. Successful exploitation lets an attacker initialize an MCP session, enumerate tools, and invoke operations against the GenieACS Northbound Interface (NBI) configured by ACS_URL. The issue is fixed in version 0.3.2.

Critical Impact
An attacker who lures a victim to a malicious web page can control Customer Premises Equipment (CPE) via GenieACS, including device reboots, firmware tasks, TR-069 parameter changes, presets, provisions, tags, connection requests, and task operations.

Affected Products

genieacs-mcp versions prior to 0.3.2 (Go binary, HTTP transport)
Deployments where TRANSPORT is not set to stdio and an HTTP listener is bound
Configurations where MCP_AUTH_TOKEN is unset and Host/Origin validation is absent

Discovery Timeline

2026-08-25 - CVE-2026-55637 published to the National Vulnerability Database (NVD)
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-55637

Vulnerability Analysis

The vulnerability is an origin validation failure classified as [CWE-346]. When genieacs-mcp runs the Streamable HTTP transport branch (httpSrv.Start(addr)), it binds an /mcp endpoint on 127.0.0.1:8080 by default. That listener accepts requests without authentication when MCP_AUTH_TOKEN is unset and never inspects the Host or Origin headers on incoming HTTP requests.

A browser is bound by the same-origin policy, but DNS rebinding sidesteps it at the network layer. An attacker registers a hostname whose DNS record initially resolves to an attacker-controlled address, then rebinds the same hostname to 127.0.0.1. Once the victim's browser reissues requests to that hostname, they land on the local MCP listener while still carrying the attacker's Origin.

The attacker then drives the MCP session directly. Tools exposed by the server proxy actions to the GenieACS NBI at ACS_URL, so the browser effectively becomes a control channel for the ACS. CPE fleet operations, including reboots, firmware pushes, and TR-069 parameter changes, become reachable from the malicious page.

Root Cause

The Go server code in cmd/server/main.go starts the HTTP transport without a Host/Origin allowlist and without requiring a bearer token when bound to loopback. Loopback binding is treated as an implicit trust boundary, which DNS rebinding breaks.

Attack Vector

Exploitation requires a victim with the vulnerable server running locally to visit an attacker-controlled page. The npm wrapper is not affected because it forces TRANSPORT=stdio and never exposes an HTTP listener. The following diff from the upstream fix shows the new configuration surface introduced to close the gap.

text

 # DEVICE_LIMIT=500
 
 # HTTP listen address (only used when TRANSPORT is not stdio, default 127.0.0.1:8080)
-# MCP_LISTEN_ADDR=127.0.0.1:8080
+# MCP_LISTEN_ADDR=127.0.0.1:8080
+
+# Bearer token for HTTP transport auth. Required when MCP_LISTEN_ADDR is non-loopback.
+# MCP_AUTH_TOKEN=
+
+# DNS-rebinding protection (HTTP transport). Loopback Host/Origin values are
+# always accepted. Add extra comma-separated names if you expose the server
+# behind a reverse proxy or hostname, or to allow a browser-based MCP client.
+# MCP_ALLOWED_HOSTS=acs.example.com
+# MCP_ALLOWED_ORIGINS=https://my-ai-app.com

Source: GitHub Commit 577306d

Detection Methods for CVE-2026-55637

Indicators of Compromise

Unexpected HTTP requests to http://127.0.0.1:8080/mcp originating from a browser process rather than a local MCP client.
Inbound requests to the MCP listener where the Host header contains an external hostname or where Origin references a non-loopback web origin.
Unscheduled GenieACS NBI activity such as refreshObject, reboot, download, or preset/provision changes traced back to sessions initiated via genieacs-mcp.

Detection Strategies

Enable HTTP access logging on genieacs-mcp and alert on any request whose Host header is not 127.0.0.1, localhost, or an explicitly allowlisted name.
Correlate MCP tool invocations with GenieACS audit logs to identify NBI operations that lack a matching operator or automation source.
Inspect endpoint DNS telemetry for short-TTL responses that resolve first to a public IP and then to 127.0.0.1 for the same hostname, a signature of DNS rebinding.

Monitoring Recommendations

Baseline the expected caller processes for the MCP listener and flag connections from browser binaries (chrome.exe, firefox.exe, msedge.exe).
Forward GenieACS NBI and MCP HTTP logs into a central analytics platform and alert on TR-069 parameter changes originating from MCP sessions outside change windows.
Track process start arguments for genieacs-mcp to confirm TRANSPORT and MCP_AUTH_TOKEN values match hardened configuration.

How to Mitigate CVE-2026-55637

Immediate Actions Required

Upgrade genieacs-mcp to version 0.3.2 or later on every host running the HTTP transport.
Set MCP_AUTH_TOKEN to a strong random value and require it on all clients.
Restrict MCP_LISTEN_ADDR to loopback and confirm no reverse proxy exposes the endpoint externally without authentication.
Configure MCP_ALLOWED_HOSTS and MCP_ALLOWED_ORIGINS to explicit values when browser-based clients are required.

Patch Information

The fix is available in GitHub Release v0.3.2 and was introduced through GitHub Pull Request #26 and GitHub Commit 577306d. Full details are documented in GitHub Security Advisory GHSA-cmwv-wf9p-p8wx.

Workarounds

Switch to the npm wrapper, which forces TRANSPORT=stdio and does not expose an HTTP listener.
Run the server with TRANSPORT=stdio when integrating with a local MCP client so no network listener is created.
Block outbound browser access to 127.0.0.1:8080 at a host firewall until the upgrade is complete.

bash

# Configuration example: hardened HTTP transport for genieacs-mcp >= 0.3.2
export TRANSPORT=http
export MCP_LISTEN_ADDR=127.0.0.1:8080
export MCP_AUTH_TOKEN="$(openssl rand -hex 32)"
export MCP_ALLOWED_HOSTS="localhost,127.0.0.1"
export MCP_ALLOWED_ORIGINS="https://my-ai-app.example.com"