Repository navigation
Security: DNS rebinding protection is opt-in, not enabled by default #3784
Description
Security Configuration Recommendation
The TransportSecurityMiddleware in mcp/server/transport_security.py has DNS rebinding protection available but disabled by default:
self.settings = settings or TransportSecuritySettings(enable_dns_rebinding_protection=False)Every deployment that does not explicitly pass TransportSecuritySettings(enable_dns_rebinding_protection=True, allowed_hosts=[...]) is vulnerable to DNS rebinding attacks.
Impact
DNS rebinding bypasses same-origin policy and allows malicious webpages to interact with local MCP servers. Most MCP servers run on localhost during development.
Recommendation
- Enable DNS rebinding protection by default
- Or at minimum: log a warning when disabled
- Document the risk prominently
- Consider a strict mode that enables all protections
Reference
Same class as GHSA-9h52-p55h-vw2f. Similar to TypeScript SDK maxToolInputElements being off by default (GHSA-46jr).
Verified in mcp 1.29.0 and 2.2.0 source.
Activity
sattyamjjain commentedon Oct 29, 2026
I checked this against main (d7845c0), and the default is narrower than the title suggests.
TransportSecuritySettings.enable_dns_rebinding_protectiondefaults toTrue(src/mcp/server/transport_security.py L26).TransportSecuritySettings(enable_dns_rebinding_protection=False)(L47-48).streamable_http_appin src/mcp/server/lowlevel/server.py (L752-757) andMCPServer.sse_app(src/mcp/server/mcpserver/server.py L1163-1168) auto-enable it whenhostis 127.0.0.1, localhost or ::1 and notransport_securityis passed.So the exposed cases are servers that build
SseServerTransportorStreamableHTTPSessionManagerdirectly without settings, and servers bound to a non-loopback host such as 0.0.0.0 withouttransport_security. Also, a request with no Origin header passes_validate_origin(L74-76).The spec (2025-11-25, basic/transports) says "Servers MUST validate the
Originheader on all incoming connections to prevent DNS rebinding attacks". A middle ground could be to keep the loopback auto-enabled and log a warning, or refuse to start when the host is non-loopback and no settings were passed.I only read main, not the 1.29.0 tag.