AIKIDO-2026-19312

@circleci/mcp-server-circleci is vulnerable to Origin Validation Error

Origin Validation ErrorGHSA-jwj7-74jh-p5c4 Published Jul 31, 2026

High Risk

This Affects:

@circleci/mcp-server-circleci

0.0.1 - 0.16.2

Fixed in 0.17.0

Are you affected? Scan for Free

TL;DR

The local MCP server's remote HTTP transport does not validate the Host or Origin headers on incoming /mcp requests. A malicious web page can use a DNS rebinding attack to bypass the browser-to-localhost boundary and reach the victim's local server endpoint, invoking any exposed MCP tool using the server-held Personal Access Token without the user's knowledge or consent. This lets a remote page trigger pipeline execution, workflow reruns, and rollbacks under the victim's CircleCI identity simply by getting them to visit a page. The fix validates Host and Origin against an allowlist that defaults to loopback, adds bind-host and allowlist configuration, and rejects disallowed requests.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you run the remote HTTP transport with a /mcp endpoint reachable from a browser on a local or network-reachable port.