The default Anki add-on offered a Streamable HTTP tool server at 127.0.0.1:3141 for Claude and other assistants. Its transport settings disabled host and origin validation intended to prevent DNS rebinding. The researcher exercised the same dispatch path with an attacker-controlled host and origin, including a request with a meaningless bearer token.…
Inspect the ClaimsCase · DiggingBeagle record
AnkiMCP default local listener let a DNS-rebound web page call agent tools
AnkiMCP through version 0.20.0 disabled DNS-rebinding protection on a default local HTTP MCP listener and did not require a per-request secret, so a malicious website could initialize MCP and call tools through the browser.
Scope
A vulnerable AnkiMCP version must be running and the user must visit the attacker page; the advisory demonstrates a controlled tool call rather than known real-world victim activity.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
The project demonstrates an origin and host validation failure on the default local MCP HTTP transport and documents a subsequent fix. A malicious web page and running vulnerable local listener are preconditions; no identified field compromise is demonstrated. Impact remains unrated because the evidence does not supply a calibrated scale for this Case.
Assessed Nov 1, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-2026-NOV01-ANKIMCP-DNS-REBIND-1 · AnkiMCP: DNS rebinding reaches unauthenticated local MCP tools
At a glance
Assess the reported tool or model action separately from the side effect actually observed.
Read the implicationsA vulnerable AnkiMCP version must be running and the user must visit the attacker page; the advisory demonstrates a controlled tool call rather than known real-world victim activity.
Limits and uncertaintyFull account
The default Anki add-on offered a Streamable HTTP tool server at 127.0.0.1:3141 for Claude and other assistants. Its transport settings disabled host and origin validation intended to prevent DNS rebinding. The researcher exercised the same dispatch path with an attacker-controlled host and origin, including a request with a meaningless bearer token. Default destructive tools remained hidden, but read and ordinary write operations could still affect local flashcards. The maintainer documents patched behavior in 0.21.0 and later releases.
Mechanism and trust boundary
- 01
Step
Claims & evidence
CLM-2026-NOV01-ANKIMCP-DNS-REBIND-1AnkiMCP through version 0.20.0 disabled DNS-rebinding protection on a default local HTTP MCP listener and did not require a per-request secret, so a malicious website could initialize MCP and call tools through the browser.supported
Basis: reported finding
- supportsAnkiMCP: DNS rebinding reaches unauthenticated local MCP toolsprimary disclosure
GHSA-j9xx-59ph-wmr6, default config.py localhost listener, disabled TransportSecuritySettings, tools/call reproduction and affected versions
Implications
Assess the reported tool or model action separately from the side effect actually observed.
Controls and mitigations
- Upgrade to a release with strict Host and Origin validation, use an explicit caller token for HTTP transport, and keep remote tunneling disabled unless necessary.
Unknowns and contradictions
- A vulnerable AnkiMCP version must be running and the user must visit the attacker page; the advisory demonstrates a controlled tool call rather than known real-world victim activity.
Sources and citation
Material revision history
- Nov 1, 2026 · Canonical change recorded · new in release · revision 211