AIKIDO-2026-344116

TL;DR

The Streamable HTTP MCP transport is created without a Host or Origin allowlist and without the SDK DNS-rebinding protection, and the server binds loopback by default. A malicious web page can use DNS rebinding to route a victim browser's requests to the local MCP listener while presenting an attacker-controlled Host and Origin, which the server accepts and processes at the MCP initialization path instead of rejecting at the HTTP boundary. When a GitLab token is present in the session, tool discovery and GitLab API tool calls execute through the forged-origin path and can return sensitive project data such as CI/CD variables. The fix enables DNS-rebinding protection with Host and Origin allowlists on the transport.