Overview
CVE-2025-66416 describes a DNS rebinding vulnerability affecting the MCP Python SDK, known as `mcp` on PyPI. This Python library implements the Model Context Protocol (MCP). Prior to version 1.23.0, the SDK did not enable DNS rebinding protection by default for HTTP-based servers. This could allow a malicious website to interact with a locally running MCP server under specific circumstances.
Technical Details
The vulnerability exists when an HTTP-based MCP server is running on localhost without authentication, utilizes FastMCP with streamable HTTP or SSE transport, and hasn’t explicitly configured TransportSecuritySettings. In this scenario, a malicious website could exploit DNS rebinding techniques to bypass same-origin policy restrictions. This allows the attacker to send requests to the local MCP server as if they originated from the user’s machine.
DNS rebinding works by tricking the browser into resolving a domain name controlled by the attacker to a local IP address (127.0.0.1 or ::1). Once this occurs, the browser treats requests to that domain as if they originate from the localhost origin, thus bypassing same-origin policy.
CVSS Analysis
Currently, a CVSS score is not available for CVE-2025-66416. The severity is marked as N/A. However, the potential impact suggests a moderate risk, depending on the functionality exposed by the MCP server. A CVSS score will likely be assigned as more information becomes available and the impact is fully assessed.
Possible Impact
If exploited successfully, this vulnerability could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user. The severity of the impact depends on the specific functionalities exposed by the MCP server and the sensitivity of the data it handles. This could potentially lead to:
- Unauthorized access to local resources.
- Execution of arbitrary commands on the user’s machine (depending on the MCP server’s functionality).
- Data leakage of sensitive information managed by the MCP server.
Important Note: The vulnerability is limited to scenarios where HTTP-based MCP servers are running locally without authentication. Running HTTP-based MCP servers locally without authentication is discouraged by MCP security best practices. The issue does not affect servers using stdio transport.
Mitigation or Patch Steps
The vulnerability is fixed in MCP Python SDK version 1.23.0. To mitigate the risk, it is strongly recommended to upgrade to version 1.23.0 or later.
You can upgrade using pip:
pip install --upgrade mcpAdditionally, consider the following security best practices:
- Avoid running HTTP-based MCP servers locally without authentication.
- Implement TransportSecuritySettings to enforce secure communication.
- Use stdio transport when appropriate.
