CVE-2026-11624: The Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent DNS rebinding attacks

Synopsis

This is a DNS rebinding vulnerability in Google MCP Toolbox for Databases, affecting all versions prior to 0.25.0. The server failed to validate the Origin header on incoming connections, allowing a remote attacker to trick a victim's browser into making cross-origin requests to the local MCP server as if they originated from a trusted source. Successful exploitation gives an attacker full read, write, and availability control over the affected service and any connected systems. A patched-image rebuild at version 0.25.0 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the MCP Toolbox server over the network, since the attack vector is Network (AV:N).

• AuthenticationNot required

  No credentials are needed to attempt this attack; the CVSS vector specifies PR:N, meaning any unauthenticated party can initiate the exploit.

• Victim interactionRequired

  The attack requires a victim to interact, such as visiting a malicious web page that performs the DNS rebinding request on their behalf (UI:A).

• Attack complexityDetail

  Attack complexity is Low (AC:L), meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors.

Blast Radius

• Reads confidential data handled by the MCP server and its connected databases, including credentials, query results, and stored records (VC:H).
• Modifies or deletes data in connected database systems, since integrity impact is High for both the vulnerable component and downstream systems (VI:H, SI:H).
• Crashes or degrades the MCP server and any services it connects to, given High availability impact across both the vulnerable and subsequent components (VA:H, SA:H).
• Pivots laterally into systems reachable through the MCP Toolbox server's database connections, extending the attacker's foothold beyond the initial target (SC:H).