Model Context Protocol

The java-sdk MCP server contained a DNS rebinding vulnerability because it performed no Origin header validation before version 1.0.0, contrary to the MCP specification. An attacker can use a malicious website opened in a victim's browser to make arbitrary tool calls to a locally or privately networked MCP server, acting as a locally connected AI agent. Servers built on frameworks with built-in Origin validation, such as Spring AI, are not affected.

The mobile_open_url tool in @mobilenext/mobile-mcp passes user-supplied URLs straight to Android's intent system through adb shell am start without scheme validation. Because MCP servers are driven by AI agents that can be manipulated through prompt injection, a malicious document or website could make the agent open tel:, sms:, mailto:, content:// or market:// URLs, enabling USSD codes, calls, SMS drafts, content provider access and app installation prompts.

The Model Context Protocol (MCP) Go SDK does not enable DNS rebinding protection by default for HTTP-based servers. A malicious website could use DNS rebinding to bypass same-origin restrictions and send requests to an HTTP-based MCP server running on localhost without authentication, using `StreamableHTTPHandler` or `SSEHandler`. This could let an attacker invoke tools or access resources on the user's behalf, and servers using stdio transport are not affected.

The FastMCP OAuthProxy does not verify user consent when it receives an authorization code from the identity provider, in its _handle_idp_callback function. Because GitHub skips the consent page for previously authorized clients, an attacker can capture a GitHub authorization URL after consenting and lure a logged-in victim to open it. The victim's browser then redirects to the malicious client's callback with a valid authorization code, which the attacker can exchange for an access token to the benign MCP server tied to the victim's GitHub account. The issue was verified only for GitHubProvider, but the flaw affects any OAuth integration whose identity provider skips consent.

FastGPT, an AI Agent building platform, has an SSRF flaw in its MCP tools endpoints, /api/core/app/mcpTools/getTools and /api/core/app/mcpTools/runTool, before version 4.14.9.5. These endpoints accept a user-supplied URL and send server-side HTTP requests to it without checking for internal or private network addresses. The application's isInternalAddress() function exists but these endpoints do not call it. An authenticated attacker can scan internal networks, reach cloud metadata services, and interact with internal services such as MongoDB and Redis.

adx-mcp-server, at latest and commit 48b2933, contains KQL injection in three MCP tool handlers: get_table_schema, sample_table_data and get_table_details. The table_name parameter is interpolated into KQL via f-strings with no validation, so a caller or a prompt-injected agent can run arbitrary KQL against the Azure Data Explorer cluster, including reading other tables and issuing management commands such as .drop table. The flaw bypasses client trust boundaries because these tools are presented as safe metadata tools.

The knowledge_search and knowledge_get_node MCP tools in @grackle-ai/mcp are listed in SCOPED_TOOLS, so scoped agents can call them, but their handlers do not receive authContext or enforce workspace scoping. A scoped agent in Workspace A can pass an arbitrary workspaceId to read knowledge graph data from Workspace B, bypassing workspace isolation (CWE-284).

The Go SDK for MCP (github.com/modelcontextprotocol/go-sdk) had a flaw in its Streamable HTTP transport. It accepted browser-generated cross-site POST requests without validating the Origin header or requiring Content-Type: application/json. Without Authorization configured, especially in stateless or sessionless setups, any website could send MCP requests to a local server and potentially trigger tool execution. Cross-site POSTs with Content-Type: text/plain could reach message handling without a CORS preflight barrier.

The Go SDK for the Model Context Protocol moved to the segmentio/encoding library for JSON parsing in version 1.3.1. The new parser matched keys that had null Unicode characters appended to their base names, so combined with duplicate keys, a "last key wins" resolution could override the intended MCP message. This could let messages evade proxies or policy layers that match exact field names, and other MCP SDKs in TypeScript and Python would reject the same messages.