Skip to content

v0.8.30 — MCP Origin/Host DNS-rebinding guard (CVE-2026-11624)

Choose a tag to compare

View all tags
@sattyamjjain sattyamjjain released this 21 Jun 15:19
v0.8.30
720fc41
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Added

Add Origin/Host DNS-rebinding guard for MCP HTTP transports (CVE-2026-11624, CWE-346)

Deny-by-default Origin/Host validation for MCP servers on an HTTP / SSE / streamable transport. Google MCP Toolbox for Databases < 0.25.0 (CWE-346 Origin Validation Error, CVSS 9.4) served a local HTTP transport that did not validate the Origin or Host header, so a browser the developer visits can DNS-rebind to 127.0.0.1 and script MCP tool calls at the local server (file reads, command execution, database access). Fixed upstream in 0.25.0 via --allowed-hosts alongside --allowed-origins, warning on the * wildcard.

  • McpOriginHostGuard (mcp_spec/mcp_origin_host_guard.py) validates the inbound Host (always) and Origin (when present) against explicit allowed_origins / allowed_hosts allow-lists; with none configured it falls back to loopback-only and records a startup warning, and a * wildcard allows all but also warns — mirroring the upstream fix. A non-browser client with no Origin is judged on Host alone. stdio is out of scope; the guard never opens a socket.
  • New McpOriginHostDecision / McpOriginHostVerdict / McpOriginHostRebindingError.
  • policy_presets.mcp_origin_host_guard_defaults(allowed_origins=…, allowed_hosts=…) — preset_id=mcp_origin_host_guard, severity=critical, owasp=MCP07, cwe=(CWE-346,), cves=(CVE-2026-11624,).
  • 16 tests; built-wheel smoke confirms a forged Host/Origin is denied and the allow-listed pair passes. Pydantic-only core, no new runtime deps. (#98)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-11624

Assets 2
Loading