CVE-2025-66416: 
Wolfi vulnerability analysis and mitigation

CVE-2025-66416 is a DNS rebinding protection bypass vulnerability in the Model Context Protocol (MCP) Python SDK (mcp on PyPI). Prior to version 1.23.0, HTTP-based MCP servers using FastMCP with streamable HTTP or SSE transport did not enable DNS rebinding protection by default, allowing a malicious website to bypass same-origin policy restrictions and send unauthorized requests to a locally running MCP server. The vulnerability was disclosed on December 2, 2025, and affects all mcp (pip) versions before 1.23.0. It carries a CVSS v3.1 score of 8.1 (High) and a CVSS v4.0 score of 7.6 (High) (Github Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-1188 (Insecure Default Initialization of Resource) and CWE-350 (Reliance on Reverse DNS Resolution for a Security-Critical Action): the SDK's FastMCP class did not configure TransportSecuritySettings by default, leaving DNS rebinding protection disabled (Github Advisory). An attacker controls a malicious domain whose DNS record initially resolves to their own server, then rapidly re-resolves to 127.0.0.1 (DNS rebinding). The victim's browser, tricked into visiting the attacker's page, then sends cross-origin requests to the local MCP server — which the browser permits because the domain now resolves to localhost. This bypasses the browser's same-origin policy and allows the attacker to invoke any tool or access any resource exposed by the unauthenticated local MCP server. The vulnerability only affects servers using HTTP-based transports (streamable HTTP or SSE); servers using stdio transport are not affected (MCP Python SDK).

Successful exploitation allows a remote attacker (via a malicious website visited by the victim) to invoke tools and access resources exposed by the victim's local MCP server, resulting in high confidentiality and integrity impact to the vulnerable system. Depending on the tools and resources registered with the MCP server, this could include reading sensitive local files, executing arbitrary actions on behalf of the user, or interacting with other local services accessible through MCP tools. Availability is not directly impacted, and there is no impact on subsequent systems beyond the local MCP server scope (Github Advisory).

No public exploit code or in-the-wild exploitation has been reported for CVE-2025-66416. The EPSS score is approximately 0.052% (17th percentile), indicating a low near-term exploitation probability (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction (the victim must visit a malicious website) and the precondition that the target is running an unauthenticated HTTP-based MCP server on localhost without TransportSecuritySettings configured — a configuration explicitly discouraged by MCP security best practices.

1. Reconnaissance: Identify potential victims likely running local MCP servers (e.g., developers using AI agent frameworks with FastMCP and HTTP/SSE transport on localhost without authentication).
2. Set up malicious domain: Register a domain and configure its DNS with a very short TTL (e.g., 1 second), initially pointing to the attacker's own server IP.
3. Serve malicious page: Host a web page on the attacker's domain that, when loaded by the victim's browser, initiates requests to the attacker's domain.
4. DNS rebinding: After the victim loads the page, the attacker changes the DNS record to resolve to 127.0.0.1. Due to the short TTL, the browser re-resolves the domain to localhost.
5. Cross-origin request to MCP server: The malicious JavaScript on the page now sends HTTP requests (e.g., to http://attacker-domain.com:<mcp_port>/) which the browser routes to 127.0.0.1:<mcp_port> — the local MCP server. The browser's same-origin policy is bypassed because the domain now resolves to localhost.
6. Invoke MCP tools/resources: The attacker's script sends valid MCP protocol requests (e.g., tool invocations or resource reads) to the local server, which processes them without authentication, returning sensitive data or performing actions on the user's behalf (Github Advisory, MCP Python SDK).

• Network: Unexpected HTTP requests to localhost MCP server ports (default: 8000) originating from browser processes; outbound connections from the MCP server process to unknown external IPs following tool invocations.
• Logs: MCP server access logs showing requests with Host headers containing external domain names (not 127.0.0.1 or localhost) while the server is bound to localhost; unusual tool invocation patterns or resource access not initiated by the local user.
• Process: Unexpected child processes or side effects spawned by MCP tool handlers (e.g., file reads, network calls) not triggered by the user directly.

Update the mcp Python package to version 1.23.0 or later, which automatically enables DNS rebinding protection for FastMCP servers when the host parameter is 127.0.0.1, localhost, or ::1 (Github Advisory, Patch Commit). For users with custom low-level server configurations using StreamableHTTPSessionManager or SseServerTransport directly, explicitly configure TransportSecuritySettings with enable_dns_rebinding_protection=True and appropriate allowed_hosts/allowed_origins. As a general best practice, always run local MCP servers with authentication enabled and avoid exposing unauthenticated HTTP-based MCP servers on localhost. IBM has also released patches for affected products including watsonx Orchestrate Developer Edition and IBM Fusion/Storage Fusion (IBM Advisory 1, IBM Advisory 2).

The vulnerability was credited to researcher JLLeitschuh and published by pcarleton of the MCP project on December 2, 2025 (Github Advisory). Red Hat tracked the issue via Bugzilla and assigned it high severity, with downstream impact assessed across multiple Red Hat products including Ansible Automation Platform (Red Hat Bugzilla). IBM subsequently issued advisories for affected products bundling the MCP Python SDK. Community discussion has highlighted the broader concern of DNS rebinding attacks against locally running AI agent infrastructure, with Microsoft publishing guidance on securing MCP control planes for agent tool execution.