GHSA-j9xx-59ph-wmr6: AnkiMCP: DNS rebinding reaches unauthenticated local AnkiMCP HTTP tools
AnkiMCP is an Anki addon that implements an MCP server, enabling AI assistants to interact with the Anki flashcard application. Prior to version 0.21.0, ankimcpserver/mcpserver.py globally disables FastMCP DNS-rebinding protection through TransportSecuritySettings with enablednsrebindingprotection=False, including for the default local Streamable HTTP listener. The defaults in ankimcpserver/config.py enable httpenabled on 127.0.0.1:3141, with an empty httppath selecting the root endpoint. No bearer token, API key, session secret, strict Host allowlist or strict Origin allowlist is enforced before initialize, tools/list and tools/call reach MCP dispatch. A victim who visits a malicious web page while Anki and the listener are running can have browser requests rebound to loopback, allowing the attacker to initialize MCP, enumerate tools, read the local collection, and perform enabled non-destructive note/deck creation or updates. The attacker needs neither LAN position nor a local process. Available operations depend on enabled tool filters; destructive tools are hidden unless enableddestructivetools is opted into, limiting deletion-level impact but not the exposed read/write operations. The reported harness confirms real MCP tool dispatch with substituted Anki bridge responses rather than demonstrating destructive changes to a real collection. Disabling protection for tunnels/proxies also disables it for the normal loopback configuration. This issue is fixed in version 0.21.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AnkiMCPto a version that resolves this vulnerability.Fixed in 0.21.0
Event History
Frequently Asked Questions
Which deployments are exposed by the default configuration?
Versions prior to 0.21.0 are exposed when Anki is running with AnkiMCP's HTTP listener enabled. The default configuration enables that listener on 127.0.0.1:3141 at the root endpoint, so it is not limited to deployments intentionally exposed on a network interface.
What must an attacker do to exploit this issue?
The victim must visit a malicious web page while Anki and the local listener are running. The attacker does not need a LAN position, local-process access, or credentials; DNS rebinding allows browser requests to reach the loopback listener.
What can an attacker access or change?
An attacker can initialize MCP, enumerate available tools, read the local collection, and use enabled non-destructive tools to create or update notes and decks. Available actions depend on the configured tool filters; deletion-level actions are hidden unless enabled_destructive_tools was explicitly enabled.
How can I tell whether my instance is affected?
Check whether the installed AnkiMCP version is earlier than 0.21.0 and whether its HTTP listener is enabled. A listener configured on 127.0.0.1:3141 with an empty HTTP path is the documented default affected setup.
What can be done if updating is not immediately possible?
Disable AnkiMCP's HTTP listener to prevent browser requests from reaching its MCP HTTP tools. Also avoid enabling destructive tools, since those expand the impact if the listener remains available.