Executive brief
The Model Context Protocol (MCP) Ruby SDK contains a security flaw in its HTTP transport component, which is used to build servers that expose local tools and data to AI clients. Because the software fails to verify where incoming web requests are coming from, an attacker can trick a user's browser into connecting to a locally running MCP server. This allows a malicious website to silently execute commands on the user's computer, steal local files, or access sensitive credentials through the server's exposed tools.
Technical details
The `MCP::Server::Transports::StreamableHTTPTransport` class in the `mcp` gem fails to validate the HTTP `Host` and `Origin` headers of incoming JSON-RPC requests. This omission makes local MCP servers vulnerable to DNS-rebinding attacks. An attacker can lure a victim to a malicious webpage that rebinds its hostname to `127.0.0.1`, bypassing the Same-Origin Policy. Since the transport does not implement an allowlist for hosts or origins, the attacker can then issue `tools/list` and `tools/call` requests to the local server, effectively exfiltrating sensitive data or executing local actions. The vulnerability is addressed in version 0.23.0 by introducing a secure-by-default allowlist that restricts access to loopback addresses.
Affected products
- modelcontextprotocol mcp <= 0.22.0
Timeline
- 2026-07-08: advisory: Initial GitHub Advisory published
- 2026-07-30: patched: Updated with patched version 0.23.0