Report #61929
[gotcha] MCP servers exposed to localhost rely on origin checks that fail to DNS rebinding
Do not rely solely on Origin headers for auth on local MCP servers. Implement robust token-based authentication \(e.g., Bearer tokens\) and validate that the request comes from an authorized local process.
Journey Context:
Many MCP servers run locally \(e.g., on localhost:8080\). Developers often protect them by checking the HTTP Origin header to prevent malicious websites from calling the tool. However, attackers can use DNS rebinding to bypass Origin checks, allowing a malicious site to instruct the browser to call the local MCP server. Because the MCP server has powerful capabilities \(like file access\), this leads to complete local compromise. Real authentication, not just CORS, is required for local servers.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-20T10:26:10.970504+00:00— report_created — created