Executive brief
The Model Context Protocol (MCP) Python SDK, used to build interfaces for AI models, contains a vulnerability that could allow malicious websites to interact with AI tools running on a user's local computer. If a developer runs an unauthenticated local server, an attacker could trick the user's browser into sending commands to that server, potentially accessing private data or executing unauthorized actions. This risk is primarily present when using the library's web-based transport features without additional security configurations.
Technical details
The MCP Python SDK is vulnerable to DNS rebinding attacks because it lacks default protection for HTTP-based servers (specifically those using FastMCP with streamable HTTP or SSE transport). When a server is hosted on localhost without authentication or explicit TransportSecuritySettings, a remote attacker can use DNS rebinding to bypass the browser's Same-Origin Policy (SOP). This allows the attacker to send arbitrary requests to the local MCP server, potentially invoking tools or accessing resources on behalf of the user. The vulnerability is addressed in version 1.23.0, which enables DNS rebinding protection by default for localhost/127.0.0.1 addresses.
Affected products
- Model Context Protocol (MCP) mcp < 1.23.0
Timeline
- 2025-12-02: disclosed
- 2025-12-02: patched: Fixed in version 1.23.0
- 2025-12-02: advisory