CVE-2026-9739: Server-Sent Events CSRF Vulnerability

CVE-2026-9739 Overview

CVE-2026-9739 is a DNS rebinding vulnerability in the Model Context Protocol (MCP) Toolbox affecting Server-Sent Events (SSE) connections under specification v2024-11-05. The flaw stems from a hardcoded Access-Control-Allow-Origin: * header in the SSE initialization handler. This header was inadvertently retained after the beta phase, bypassing the allowed-origins and allowed-hosts flags introduced to align with MCP security guidelines. Attackers can exploit the permissive CORS policy to perform DNS rebinding attacks against local MCP Toolbox instances. This vulnerability falls under [CWE-942] Permissive Cross-domain Policy with Untrusted Domains.

Critical Impact
Remote attackers can bypass origin restrictions and execute arbitrary MCP tool calls against locally bound Toolbox instances through a victim's browser.

Affected Products

MCP Toolbox (googleapis/mcp-toolbox) using SSE transport
Deployments conforming to MCP specification v2024-11-05
Toolbox instances bound to localhost or internal network interfaces

Discovery Timeline

2026-05-27 - CVE-2026-9739 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-9739

Vulnerability Analysis

The MCP Toolbox exposes tool invocations through an HTTP server that supports SSE transport. During beta, the maintainers added allowed-origins and allowed-hosts configuration flags to restrict which web origins could initiate connections. However, the SSE initialization handler retained a hardcoded Access-Control-Allow-Origin: * response header. This wildcard header overrides the origin allowlist for the initial SSE handshake, granting any web origin permission to read the SSE stream.

Because the Toolbox typically binds to loopback or internal addresses, attackers cannot reach it directly. They instead exploit DNS rebinding to coerce a victim's browser into treating an attacker-controlled domain as same-origin with the local Toolbox instance. Once rebound, the browser issues SSE requests that the Toolbox accepts and processes, returning tool execution responses to the attacker's JavaScript.

Root Cause

The root cause is an inconsistency between configured CORS policy and the actual response headers emitted by the SSE initialization route. The allowed-origins flag governs validation logic elsewhere, but the SSE handler emits Access-Control-Allow-Origin: * unconditionally. The wildcard response defeats the browser-enforced Same-Origin Policy that would otherwise block cross-origin reads of SSE event streams.

Attack Vector

An attacker lures a victim to a malicious page that resolves an attacker-controlled hostname. The page polls until DNS responses rebind to a local address such as 127.0.0.1 where the Toolbox listens. Because the SSE handler returns a permissive CORS header, the victim's browser allows the malicious page to open the SSE stream and invoke registered MCP tools. The attacker reads results, exfiltrates data, or pivots into downstream systems the Toolbox can access.

No authentication is required when the Toolbox is configured without additional access controls. User interaction is limited to visiting the attacker-controlled web page. Technical exploitation details are documented in GitHub Issue #3053 and the corresponding fix in GitHub Pull Request #3054.

Detection Methods for CVE-2026-9739

Indicators of Compromise

SSE connections to the MCP Toolbox originating from Origin headers not present in the configured allowed-origins list.
HTTP responses from the Toolbox containing Access-Control-Allow-Origin: * on /sse initialization routes.
Tool invocation requests immediately following an SSE handshake from browser User-Agents on developer workstations.

Detection Strategies

Inspect outbound HTTP responses from MCP Toolbox processes for wildcard CORS headers on SSE endpoints.
Correlate browser process telemetry with localhost connections to MCP Toolbox ports during web browsing sessions.
Alert on DNS responses for external domains that resolve to RFC1918 or loopback addresses, a hallmark of DNS rebinding.

Monitoring Recommendations

Log every SSE handshake with full request headers, including Origin, Host, and Referer.
Monitor for repeated DNS resolutions of the same external hostname returning differing IP answers within short windows.
Capture audit trails of MCP tool invocations and flag tool calls initiated from non-CLI clients.

How to Mitigate CVE-2026-9739

Immediate Actions Required

Upgrade the MCP Toolbox to a release that includes the fix from Pull Request #3054.
Restrict Toolbox network exposure by binding only to loopback interfaces protected by host-based firewalls.
Disable the SSE transport where it is not required, preferring the streamable HTTP transport defined in newer MCP specifications.

Patch Information

The maintainers removed the hardcoded Access-Control-Allow-Origin: * header from the SSE initialization handler so that the allowed-origins flag governs CORS responses consistently. Apply the fix shipped via Pull Request #3054 and verify the running version after upgrade.

Workarounds

Place the Toolbox behind a reverse proxy that enforces strict Origin validation and strips wildcard CORS headers from /sse responses.
Configure host-based DNS protections or browser extensions that block resolution of external domains to private IP ranges.
Run the Toolbox inside an isolated container without access to sensitive downstream services until the patch is deployed.

bash

# Configuration example: restrict origins and bind to loopback
toolbox \
  --address 127.0.0.1 \
  --port 5000 \
  --allowed-origins https://trusted.internal.example \
  --allowed-hosts trusted.internal.example