CVE-2026-61546: AnkiMCP: DNS rebinding reaches unauthenticated local AnkiMCP HTTP tools
AnkiMCP is an Anki addon that implements an MCP server, enabling AI assistants to interact with the Anki flashcard application. Prior to version 0.21.0, ankimcpserver/mcpserver.py globally disables FastMCP DNS-rebinding protection through TransportSecuritySettings with enablednsrebindingprotection=False, including for the default local Streamable HTTP listener. The defaults in ankimcpserver/config.py enable httpenabled on 127.0.0.1:3141, with an empty httppath selecting the root endpoint. No bearer token, API key, session secret, strict Host allowlist or strict Origin allowlist is enforced before initialize, tools/list and tools/call reach MCP dispatch. A victim who visits a malicious web page while Anki and the listener are running can have browser requests rebound to loopback, allowing the attacker to initialize MCP, enumerate tools, read the local collection, and perform enabled non-destructive note/deck creation or updates. The attacker needs neither LAN position nor a local process. Available operations depend on enabled tool filters; destructive tools are hidden unless enableddestructivetools is opted into, limiting deletion-level impact but not the exposed read/write operations. The reported harness confirms real MCP tool dispatch with substituted Anki bridge responses rather than demonstrating destructive changes to a real collection. Disabling protection for tunnels/proxies also disables it for the normal loopback configuration. This issue is fixed in version 0.21.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AnkiMCPto a version that resolves this vulnerability.Fixed in 0.21.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Versions before 0.21.0 are exposed when the HTTP listener is enabled. The documented defaults enable HTTP on 127.0.0.1:3141 with the root endpoint, so a default local listener is affected.
What does an attacker need to exploit this?
The victim must visit a malicious web page while Anki and the AnkiMCP listener are running. The attacker does not need a LAN position or a process on the victim's machine.
What actions could an attacker perform?
An attacker can initialize MCP, list available tools, read the local collection, and use enabled non-destructive tools to create or update notes and decks. Available actions depend on configured tool filters; destructive tools are not exposed unless enabled_destructive_tools has been explicitly enabled.
What authentication or request-origin controls protect the listener?
Before MCP dispatch, the affected listener enforces no bearer token, API key, session secret, strict Host allowlist, or strict Origin allowlist. DNS-rebinding protection is also globally disabled in the affected implementation.