Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-61546— AnkiMCP: DNS rebinding reaches unauthenticated local AnkiMCP HTTP tools

Quick assessment

Affected
ankimcp anki-mcp-server-addon
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

AnkiMCP 是一个 Anki 插件，它实现了一个 MCP（Model Context Protocol）服务器，使 AI 助手能够与 Anki 闪卡应用程序进行交互。在 0.21.0 版本之前， 通过 将 设置为 ，从而在全局范围内禁用了 FastMCP 的 DNS 重绑定保护机制，该设置同样适用于默认的本地 Streamable HTTP 监听器。 中的默认配置启用了 ，监听地址为 ，且 为空，表示选择根端点。在 、 和 等请求到达 MCP 分发器之前，系统并未强制实施任何凭据验证（如 Bearer Toke

CVSS 8.8 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-61546

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
AnkiMCP: DNS rebinding reaches unauthenticated local AnkiMCP HTTP tools
Source: CVE Program / CVE List V5
Vulnerability Description
AnkiMCP is an Anki addon that implements an MCP server, enabling AI assistants to interact with the Anki flashcard application. Prior to version 0.21.0, `anki_mcp_server/mcp_server.py` globally disables FastMCP DNS-rebinding protection through `TransportSecuritySettings` with `enable_dns_rebinding_protection=False`, including for the default local Streamable HTTP listener. The defaults in `anki_mcp_server/config.py` enable `http_enabled` on `127.0.0.1:3141`, with an empty `http_path` selecting the root endpoint. No bearer token, API key, session secret, strict `Host` allowlist or strict `Origin` allowlist is enforced before `initialize`, `tools/list` and `tools/call` reach MCP dispatch. A victim who visits a malicious web page while Anki and the listener are running can have browser requests rebound to loopback, allowing the attacker to `initialize` MCP, enumerate tools, read the local collection, and perform enabled non-destructive note/deck creation or updates. The attacker needs neither LAN position nor a local process. Available operations depend on enabled tool filters; destructive tools are hidden unless `enabled_destructive_tools` is opted into, limiting deletion-level impact but not the exposed read/write operations. The reported harness confirms real MCP tool dispatch with substituted Anki bridge responses rather than demonstrating destructive changes to a real collection. Disabling protection for tunnels/proxies also disables it for the normal loopback configuration. This issue is fixed in version 0.21.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
源验证错误
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
ankimcp anki-mcp-server-addon < 0.21.0 -

II. Public POCs for CVE-2026-61546

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-61546

请登录查看更多情报信息。

Other References for CVE-2026-61546 (4)

IV. Related Vulnerabilities

Same weakness: CWE-346