CVE-2026-11624: Critical severity Model Context Protocol Model Context Protocol vulnerability
The Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent DNS rebinding attacks. Prior to the v0.25.0 release, users had no way to validate the origin's host. In v0.25.0, a new "--allowed-hosts" flag was introduced alongside the existing "--allowed-origins" flag, enabling users to specify permitted hosts at server startup. Both flags default to "", allowing users to implement strict access controls as needed without breaking existing setups. If either flag is set to "", the server will output a startup warning about potential vulnerabilities. Documentation has also been updated to highlight these security considerations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Model Context Protocolto a version that resolves this vulnerability.Fixed in v0.25.0 - Configuration
Start the server with --allowed-hosts set to a comma-separated list of permitted hostnames (do not leave as the default "*") to limit accepted Origin hosts. If set to "*" the server will emit a startup warning about potential vulnerabilities.
Model Context Protocol server --allowed-hosts = restrictive list (not "*") - Configuration
Start the server with --allowed-origins set to a comma-separated list of permitted origin values (do not leave as the default "*") to restrict allowed Origins. If set to "*" the server will emit a startup warning about potential vulnerabilities.
Model Context Protocol server --allowed-origins = restrictive list (not "*") - Configuration
Validate the HTTP "Origin" header on all incoming connections to prevent DNS rebinding attacks; ensure the server logic rejects requests whose Origin host is not in the configured allowed hosts/origins.
Model Context Protocol server Origin header validation = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11624?
CVE-2026-11624 has a severity rating of critical at 9.4 according to the CVSS scoring system.
How do I fix CVE-2026-11624?
To mitigate CVE-2026-11624, update to version 0.25.0 or later and use the '--allowed-hosts' flag to validate the 'Origin' header.
What type of vulnerability is CVE-2026-11624?
CVE-2026-11624 is a vulnerability associated with inadequate validation of the 'Origin' header which can lead to DNS rebinding attacks.
What is the potential impact of CVE-2026-11624?
Exploiting CVE-2026-11624 can allow attackers to manipulate DNS responses, potentially compromising user privacy and server security.
When was CVE-2026-11624 published?
CVE-2026-11624 was published on June 13, 2026.