Description

The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcp_server_dash.py constructed the server for its network mode with the interface restricted to loopback and no transport-security settings, so a name that had been pointed at the loopback address still reached the listener while carrying the attacker's host name. A page in a visitor's browser could therefore drive the local server and invoke its company-search and file-detail tools under the Dropbox credential the server holds. Only the network mode was reachable this way; the standard input mode was not. The fix supplies transport-security settings that enable host checking and allow only the loopback name and port, rejecting other hosts before a tool runs. The repository publishes no versions, so the affected boundary is the commit preceding the fix.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-08-27T17:20:52.927Z",
  "pubdate": "2026-08-27T17:20:52.927Z",
  "executiveSummary": "The Dash MCP server is vulnerable to a cross-site request forgery and host header manipulation vulnerability within its network-mode configuration. By binding the listener to the loopback interface without implementing host header verification, the server inadvertently processes requests from unauthorized origins that resolve to the local loopback address.\nAn attacker can leverage a victim's browser to execute requests against the local Dash MCP server. This allows for unauthorized invocation of sensitive functions, specifically 'company-search' and 'file-detail' tools, utilizing the credentials held by the server instance. This flaw poses a significant security risk, as it allows external web content to bypass local network boundaries and interact with authenticated system resources. The vulnerability affects the implementation within 'src/mcp_server_dash.py'. Exploitation requires the victim to visit a malicious webpage while the Dash MCP server is running in network mode, granting the attacker the ability to perform operations on behalf of the authenticated user.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient transport-layer security configuration within 'src/mcp_server_dash.py'. While the Dash MCP server restricts its network interface to the loopback address (127.0.0.1), it fails to perform host header validation on incoming HTTP requests. Consequently, the server accepts requests where the Host header does not match the expected loopback designation.\nAttack flow: When a user visits a malicious website, the browser can be instructed to send cross-origin requests to 'http://localhost' or any domain name that resolves to the local loopback address. Because the MCP server does not verify the 'Host' header, it treats these external requests as legitimate, local traffic. The server then executes the requested tools using its own elevated credentials, which may be associated with sensitive services such as Dropbox.\nThe exploitation process involves the following steps: 1. The victim launches the Dash MCP server in network mode. 2. The victim navigates to a malicious URL controlled by the attacker. 3. The malicious page executes JavaScript (e.g., via 'fetch' or 'XMLHttpRequest') targeting the local Dash MCP server listener. 4. Due to the absence of origin or host checking, the server interprets these commands as internal. 5. The server invokes backend tools, such as 'company-search' or 'file-detail', and returns the sensitive data back to the attacker's page via the victim's browser session. 6. The attacker harvests the exfiltrated data.\nThis vulnerability is strictly limited to the network-mode configuration of the server. The standard input (stdin) mode remains unaffected as it does not rely on network-based host header parsing. The scope of the vulnerability includes all commits prior to the implementation of the host-checking fix in the repository. The impact is significant as it facilitates unauthorized access to private data and system tools, effectively bypassing browser-based Same-Origin Policy (SOP) protections through the misconfigured local listener.\nThe fix necessitates the implementation of a transport-security layer that strictly enforces host validation. By rejecting requests that do not match the expected loopback hostname and port, the server prevents the processing of illegitimate requests originated from external browser contexts."
}