MCP Ruby SDK DNS Rebinding via Missing Host/Origin Validation in StreamableHTTPTransport
First seen Jul 30, 2026 · Updated Jul 30, 2026
The MCP Ruby SDK's HTTP transport failed to validate Host or Origin headers before version 0.23.0, allowing a malicious website to use DNS rebinding to reach a locally running MCP server from a victim's browser. This lets an attacker invoke tools exposed by the local MCP server without authorization, effectively bypassing the same-origin trust boundary that localhost services normally rely on.
Technical Analysis
MCP servers using StreamableHTTPTransport listen on localhost and implicitly trust any request that reaches that port, since no validation of the Host or Origin header is performed. An attacker lures a victim to a malicious webpage that uses DNS rebinding: the domain initially resolves to an attacker server to load the page, then the DNS record is switched to 127.0.0.1, allowing subsequent JavaScript fetch/XHR requests from that origin to be routed to the local MCP server while still passing the browser's same-origin policy checks. The attacker's page can then send crafted requests that the MCP server treats as legitimate local traffic, invoking any exposed tools (file access, code execution, shell commands, etc., depending on server configuration). This crosses the trust boundary between the browser sandbox and a privileged local process, effectively turning any tool the MCP server exposes into a remotely triggerable action.
Affected Systems
mcp (Ruby gem), MCP Ruby SDK; protocols: MCP
Detection Signatures
- Incoming requests to local MCP server with unexpected or wildcard-like Host headers
- Requests with Origin header pointing to unrelated external domains
- Rapid DNS TTL changes / DNS responses alternating between external IP and 127.0.0.1 for the same domain (DNS rebinding indicator)
- Unexpected tool invocation requests originating from browser User-Agent strings
- MCP server access logs showing requests without expected client authentication tokens
Remediation Steps
- 1
Upgrade MCP Ruby SDK
Update the mcp gem to version 0.23.0 or later, which adds Host/Origin header validation to StreamableHTTPTransport.
- 2
Enforce strict Host/Origin allowlisting
Configure the MCP server to reject requests whose Host or Origin header does not match an explicit allowlist of trusted values.
- 3
Bind to loopback with additional auth
Require a shared secret, token, or mutual TLS for local MCP server connections even when bound to localhost, so DNS rebinding alone cannot authorize tool calls.
- 4
Disable unnecessary browser-reachable transports
Where possible, disable or firewall the HTTP transport for MCP servers that do not need to be reachable from browser contexts, using stdio or Unix sockets instead.
- 5
Monitor for DNS rebinding patterns
Deploy DNS monitoring/logging to detect rapid re-resolution of external domains to loopback or private IP addresses.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.