CVE-2025-66416 - CVE House
Back to Database
Status published High CVE-2025-66416

DNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK for Servers Running on Localhost

Vulnerability Description

The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.23.0, tThe Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication using FastMCP with streamable HTTP or SSE transport, and has not configured TransportSecuritySettings, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances. Note that running HTTP-based MCP servers locally without authentication is not recommended per MCP security best practices. This issue does not affect servers using stdio transport. This vulnerability is fixed in 1.23.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-66416

Credits & Attribution

No credits recorded in the NVD database.

References

More from modelcontextprotocol

View All →
CVE-2025-68145
mcp-server-git has missing path validation when using --repository flag
Medium 6.4
CVE-2025-68144
mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files
Medium 6.3
CVE-2025-68143
mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations
Medium 6.5
CVE-2025-66414
DNS Rebinding Protection Disabled by Default in Model Context Protocol TypeScript SDK for Servers Running on Localhost
High 7.6
CVE-2025-58444
MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server
High 8.6

Affected Vendor

modelcontextprotocol

View all reports →

Affected Software

python-sdk
Vulnerable Versions:
< 1.23.0

Timeline

Official Publish: December 2nd, 2025
Last Modified: December 2nd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-1188

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.