Jan Local API CORS Wildcard / Trusted Host Bypass Exposing MCP Tooling

Technical Analysis

The vulnerability stems from a CORS misconfiguration where the server's trusted-host allowlist logic is overridden by a wildcard origin reflection combined with credentialed requests (Access-Control-Allow-Origin reflecting requester + Access-Control-Allow-Credentials: true), which violates the CORS security model designed to prevent exactly this combination. An attacker on the same local network, or a remote attacker using a DNS rebinding technique to make the victim's browser resolve an attacker-controlled domain to localhost/loopback, can issue cross-origin requests to the local OpenAI-compatible API without authentication. Because this API layer also brokers MCP tool invocation, the attacker gains the ability to call arbitrary registered MCP tools, enumerate available models, trigger inference, and read back response data cross-origin — effectively achieving unauthorized tool execution and data exposure through the browser-to-local-server trust boundary. This crosses the boundary between an untrusted web origin and a privileged local agent runtime, turning a browser-based attacker into a de facto authenticated client of the agent's tool layer.

Affected Systems

Jan (local API server); protocols: MCP

Detection Signatures

• Access-Control-Allow-Origin header reflecting arbitrary/unexpected Origin values on local API responses
• Access-Control-Allow-Credentials: true combined with a reflected/wildcard Allow-Origin
• Unexpected cross-origin requests to loopback/127.0.0.1 or local hostnames bound to the Jan API port
• DNS responses resolving external-looking domains to 127.0.0.1/localhost (possible rebinding attempt)
• Unauthenticated calls to /v1/models, /v1/chat/completions, or MCP tool-invocation endpoints originating from browser-like User-Agent/Origin headers not matching the configured trusted host list

Remediation Steps

1. 1

   Upgrade Jan

   Update to the patched version containing commit 3e1c1e7 or later, which fixes the trusted-host/CORS wildcard logic.

2. 2

   Restrict CORS policy

   Ensure the local API server enforces an explicit origin allowlist and never combines wildcard/reflected origins with Access-Control-Allow-Credentials: true.

3. 3

   Require authentication on local API

   Enable API key or token authentication for the OpenAI-compatible local endpoint, including MCP tool invocation routes, rather than relying solely on network locality.

4. 4

   Mitigate DNS rebinding

   Validate the Host header against an allowlist server-side and reject requests with unexpected Host values, independent of CORS headers.

5. 5

   Network segmentation

   Bind the local API server to loopback-only interfaces where possible and avoid exposing it on shared/untrusted local networks.