CVE-2026-81102: Dropbox Dash MCP Server DNS Rebinding via Missing Host Header Validation
The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcpserverdash.py constructed the server for its network mode with the interface restricted to loopback and no transport-security settings, so a name that had been pointed at the loopback address still reached the listener while carrying the attacker's host name. A page in a visitor's browser could therefore drive the local server and invoke its company-search and file-detail tools under the Dropbox credential the server holds. Only the network mode was reachable this way; the standard input mode was not. The fix supplies transport-security settings that enable host checking and allow only the loopback name and port, rejecting other hosts before a tool runs. The repository publishes no versions, so the affected boundary is the commit preceding the fix.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the Dash MCP server network-mode transport-security settings to enable host checking and only allow the loopback name and port. Requests with other Host headers must be rejected before invoking company-search or file-detail tools.
Dash MCP server (src/mcp_server_dash.py, network mode) transport-security / host checking (enable host checking and restrict allowed host to loopback name and port) = enable host checking; allow only loopback name and port; reject other hosts before a tool runs
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users running the Dash MCP server in network mode are exposed if they browse to an attacker-controlled page. Standard input mode is not reachable through this issue.
What does exploitation require?
An attacker must get a victim to visit a page that can perform DNS rebinding so its hostname resolves to the loopback address while requests retain the attacker-controlled Host header. Exploitation does not require prior privileges, but it requires user interaction and has high attack complexity.
What could an attacker access?
The attacker-controlled browser page could invoke the local server's company-search and file-detail tools using the Dropbox credential held by the server. The reported impact is limited to confidentiality.
What should be done if patching is not immediately possible?
Avoid using network mode until the fix is applied, and use standard input mode instead where feasible. The fix enables host checking that permits only the loopback name and port.
How can I determine whether my deployment is affected?
Check whether the server is running in network mode and whether its configuration lacks transport-security settings that validate the Host header and restrict allowed hosts to the loopback name and port. The repository does not publish versions; the affected boundary is the commit immediately before the fix.