genieacs-mcp DNS Rebinding to Unauthenticated MCP Server (CVE-2026-55637)
First seen Aug 26, 2026 · Updated Aug 26, 2026
The genieacs-mcp MCP server, prior to version 0.3.2, exposes an unauthenticated HTTP listener on localhost by default and fails to validate Host/Origin headers, making it vulnerable to DNS rebinding attacks from malicious websites. An attacker who lures a victim to a malicious webpage can pivot through the victim's browser into the local MCP server and issue commands against the GenieACS TR-069 ACS backend, potentially rebooting devices, altering firmware tasks, or changing CPE configuration. This is a genuine, well-documented vulnerability with a clear exploitation path and meaningful impact on managed device fleets.
Technical Analysis
The MCP server binds an unauthenticated Streamable HTTP transport to 127.0.0.1:8080 by default when MCP_AUTH_TOKEN is not set, and the httpSrv.Start(addr) code path omits Host/Origin header validation. Using classic DNS rebinding, an attacker-controlled webpage first resolves a domain to a public IP to pass initial checks, then rebinds it to 127.0.0.1 once the victim's browser has cached the origin, allowing cross-origin browser requests to reach the loopback MCP listener as if they were same-origin. Once connected, the attacker can initialize an MCP session, enumerate available tools, and invoke them to interact with the GenieACS NBI configured via ACS_URL — enabling device reboots, firmware task creation, TR-069 parameter writes, preset/provision/tag manipulation, and arbitrary connection requests. This crosses the browser-to-local-service trust boundary and the MCP tool-invocation boundary, turning a victim's local developer/admin machine into an unwitting proxy for attacking production CPE infrastructure. The npm/stdio wrapper is unaffected since it never opens a network listener.
Affected Systems
genieacs-mcp; protocols: MCP
Detection Signatures
- Unexpected inbound HTTP requests to 127.0.0.1:8080/mcp with varying Host header values
- MCP session initialization requests originating from browser-like User-Agent strings without an Authorization/MCP_AUTH_TOKEN header
- Rapid DNS resolution changes for domains contacting local ports (classic DNS rebinding pattern)
- GenieACS NBI logs showing task creation, reboot, or provisioning changes correlated with MCP server activity but no legitimate admin session
- Absence of Origin/Host header validation in MCP server access logs
Remediation Steps
- 1
Upgrade genieacs-mcp
Update to version 0.3.2 or later, which addresses the missing authentication and header validation issues.
- 2
Set MCP_AUTH_TOKEN
Always configure a strong MCP_AUTH_TOKEN so the HTTP listener requires authentication before accepting MCP sessions.
- 3
Enforce Host/Origin validation
Ensure the server (post-patch) validates Host and Origin headers to reject cross-origin browser requests, mitigating DNS rebinding.
- 4
Prefer stdio transport
Where network exposure is not required, use the npm wrapper with stdio transport, which does not open an HTTP listener.
- 5
Network segmentation
Bind the MCP listener to a non-default port/interface and restrict access via host-based firewall rules even for localhost services.
- 6
Monitor GenieACS NBI activity
Audit and alert on unexpected task creation, reboots, or configuration changes originating from local MCP server sessions.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.