Repository navigation
[Security] DNS rebinding protection disabled by default — all default MCP servers vulnerable #2269
Description
Security Issue: Insecure Default Configuration
File: src/mcp/server/transport_security.py lines 40–41
Issue: TransportSecurityMiddleware disables DNS rebinding protection by default:
# If not specified, disable DNS rebinding protection by default for backwards compatibility
self.settings = settings or TransportSecuritySettings(enable_dns_rebinding_protection=False)Developers following official examples and tutorials do not pass security_settings — they deploy without DNS rebinding protection.
Impact
An attacker on the same network (coffee shop Wi-Fi, corporate network) can:
- Serve a malicious webpage with DNS rebinding payload
- Connect attacker JS to victim's local MCP server (bypasses same-origin)
- Invoke any registered MCP tool — file reads, shell commands, API calls
Recommended Fix
Change the default to secure-by-default:
def __init__(self, settings: TransportSecuritySettings | None = None):
# Secure by default
self.settings = settings or TransportSecuritySettings(enable_dns_rebinding_protection=True)Provide explicit opt-out for backwards compatibility.
Reported by @hhhashexe · SkillFence Security
Activity
pcarleton commentedon Mar 12, 2026
Thanks for the report. This was addressed in v1.23.0 (Dec 2025) — see commit d3a1841.
The middleware fallback at
transport_security.py:41is intentionally permissive for backwards compat, but it's not reached in default configurations. Bothsse_app()(mcpserver/server.py:919-925) andstreamable_http_app()(lowlevel/server.py:529-535) auto-enable DNS rebinding protection whenhostis127.0.0.1,localhost, or::1and no explicittransport_securityis provided.Since the default host is
127.0.0.1, servers following official examples are protected.The fallback only applies if you construct transport primitives directly without going through
MCPServer— at which point you've opted into manual configuration.Closing as already fixed.
For future reports: if you believe you've found an exploitable vulnerability, please use GitHub's private vulnerability reporting rather than a public issue. It lets us assess and coordinate a fix in private. Public issues are fine for hardening suggestions or defense-in-depth ideas that aren't directly exploitable.
docs(examples): add DNS rebinding protection to low-level transport e…