DNS Rebinding Affecting mcp package, versions <0.23.0
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUBY-MCP-18016342
- published19 Jul 2026
- disclosed17 Jul 2026
- credittonghuaroot, KairoKid, HE WEI
Introduced: 17 Jul 2026
NewCVE-2026-63118 (opens in a new tab)How to fix?
Upgrade mcp to version 0.23.0 or higher.
Overview
mcp is a The official Ruby SDK for Model Context Protocol servers and clients
Affected versions of this package are vulnerable to DNS Rebinding in the handle_post method of MCP::Server::Transports::StreamableHTTPTransport in lib/mcp/server/transports/streamable_http_transport.rb, which processes JSON-RPC requests after checking Accept, Content-Type, Mcp-Session-Id, and protocol version but never reads HTTP_HOST or HTTP_ORIGIN. An attacker can drive a victim's locally running MCP server, invoke its exposed tools, and exfiltrate their output such as files, secrets, or command results by luring the victim to a webpage that rebinds its hostname to a loopback address and posts JSON-RPC requests with forged Host and Origin headers. Exploitation requires the victim to run the server on a reachable HTTP port over loopback or the LAN and to visit the attacker's page, and the impact depends on which tools the server exposes.