CVE-2026-63118: MCP Ruby SDK SSRF Vulnerability

CVE-2026-63118 Overview

CVE-2026-63118 affects the MCP Ruby SDK, the official Ruby implementation of the Model Context Protocol (MCP) for servers and clients. The MCP::Server::Transports::StreamableHTTPTransport class in the mcp gem fails to validate the HTTP Host and Origin request headers. This missing origin validation ([CWE-346]) allows a malicious web page to use DNS rebinding to reach a locally running MCP server and invoke exposed tools from the victim's browser. The vulnerability affects all versions prior to 0.23.0 and is fixed in version 0.23.0.

Critical Impact
A user visiting an attacker-controlled web page can trigger tool invocations on a locally bound MCP server, leading to unauthorized command execution through exposed MCP tools.

Affected Products

MCP Ruby SDK (mcp gem) versions prior to 0.23.0
Applications embedding MCP::Server::Transports::StreamableHTTPTransport
Local MCP servers listening on loopback interfaces without reverse proxies enforcing host checks

Discovery Timeline

2026-07-29 - CVE-2026-63118 published to NVD
2026-07-29 - Last updated in NVD database
Patch released - Fixed in mcp gem version 0.23.0 (see GitHub Release v0.23.0)

Technical Details for CVE-2026-63118

Vulnerability Analysis

The MCP Ruby SDK provides an HTTP transport that streams JSON-RPC messages between MCP clients and servers. When a developer runs an MCP server locally, the StreamableHTTPTransport accepts any incoming HTTP request without confirming that the Host or Origin header matches an allowlist. Browsers routinely send requests to whatever hostname resolves in DNS, so a page loaded from an attacker-controlled domain can be steered to a 127.0.0.1 address through DNS rebinding. Once rebound, the browser attaches the attacker's origin to requests aimed at the local MCP endpoint. The server treats these requests as legitimate and executes the tools that the local user has exposed. This turns any browser session into a delivery channel for MCP tool invocation, including tools that read files, run commands, or interact with connected AI models. See the GitHub Security Advisory GHSA-rjr6-rcgv-9m7m for the maintainer analysis.

Root Cause

The root cause is [CWE-346] Origin Validation Error. StreamableHTTPTransport did not compare the request Host header against an expected value such as localhost or 127.0.0.1, nor did it enforce an Origin allowlist. Local network services must validate these headers to defend against DNS rebinding, and this control was absent in versions prior to 0.23.0.

Attack Vector

An attacker hosts a page under a domain they control, for example attacker.example. The DNS response first resolves to a public IP, then flips to 127.0.0.1 after a short TTL. JavaScript on the page issues fetch calls to attacker.example on the MCP server port. The browser reuses the rebound address, sends the request to the local MCP server, and includes the attacker's origin. Without header validation, the server processes the JSON-RPC payload and invokes any exposed MCP tool. The fix in commit ba54308 adds Host and Origin header validation to reject rebound requests.

Detection Methods for CVE-2026-63118

Indicators of Compromise

Inbound HTTP requests to the local MCP port with Origin or Referer headers referencing external domains.
Requests to the MCP server whose Host header is not localhost, 127.0.0.1, or [::1].
Unexpected MCP tool invocations correlated with active browser sessions on the same host.

Detection Strategies

Enable HTTP access logging on the MCP transport and alert on requests whose Host header falls outside an allowlist of loopback names.
Inspect endpoint telemetry for ruby processes spawning child processes shortly after browser network activity to the MCP port.
Use browser network policies or extensions that block cross-origin requests to RFC1918 and loopback addresses.

Monitoring Recommendations

Track the installed mcp gem version across developer workstations and CI runners; flag any version below 0.23.0.
Monitor DNS resolver logs for domains whose responses alternate between public and loopback addresses within a single session.
Record MCP tool invocation history and review invocations that occur without a corresponding developer action.

How to Mitigate CVE-2026-63118

Immediate Actions Required

Upgrade the mcp gem to version 0.23.0 or later in every project that runs an MCP server.
Audit deployed MCP servers for exposed tools and remove tools that are not required for the current workflow.
Bind MCP servers to 127.0.0.1 explicitly and confirm that no firewall rule forwards external traffic to the MCP port.

Patch Information

The fix ships in mcp gem version 0.23.0. The patch introduces validation of the HTTP Host and Origin headers in MCP::Server::Transports::StreamableHTTPTransport, rejecting requests that do not match the expected local origin. Review the change in the GitHub commit ba54308 and the v0.23.0 release notes.

Workarounds

Place the MCP server behind a reverse proxy that validates the Host header and rejects unknown origins.
Require an authentication token on every MCP request and reject requests missing the token, since browsers cannot read tokens from cross-origin contexts.
Disable the HTTP transport and use the stdio transport for local development until the upgrade to 0.23.0 is complete.

bash

# Configuration example: upgrade the mcp gem and pin the minimum version
bundle update mcp --conservative
# Or edit Gemfile:
#   gem "mcp", ">= 0.23.0"
bundle install
bundle info mcp | grep -i version