SSRF via DNS Rebinding in @abomruseel/can-mcp-server: Incomplete Fix of CVE-2026-53509

SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509 Vulnerability Overview Vulnerability Type: SSRF (Server-Side Request Forgery) Severity: Medium (CVSS 5.7) Root Cause: The function in only validates the hostname string without resolving DNS. Attackers can use DNS rebinding or AAAA records to resolve a domain name to an internal IP, bypassing checks based on IP literals. Vulnerability Description: The SSRF protection function (added for CVE-2026-33080 and extended for CVE-2026-53509) only validates the hostname string and never resolves DNS. Any caller-provided whose hostname resolves to an internal address will pass the check, allowing attackers to access loopback addresses and cloud metadata (169.254.169.254). This is the third bypass for the same vulnerability and remains present in the current latest version 0.4.107—more severe than the fix for CVE-2026-53509, which only blocked loopback addresses. Scope of Impact Affected Package: Affected Versions: <= 0.4.107 Fixed Version: 0.4.106 (Note: This is as stated in the original text; there may be a version labeling error) Impact: Caller-controlled SSRF can access loopback addresses, RFC-1918 addresses, and 169.254.169.254 (cloud metadata — IAM credentials), with the response body returned to the caller (non-blind). In the default stdio deployment, prompt injection is required to access the parameter; the self-hosted HTTP transport is unauthenticated, allowing any remote client to trigger it directly. Remediation Resolve the hostname and verify that all resolved IPs belong to private address ranges, then pin the connection to the validated IP (using a custom / or re-resolution that cannot pin to internal addresses)—or require the existing allowlist (disabled by default, especially for HTTP transport). Merely returning an error string is insufficient to close this vulnerability. POC Code Output: A real attacker would use any domain whose AAAA record points to an internal IP, or employ DNS rebinding. nip.io is used only for the self-contained nature of the POC.

Goal Reached Thanks to every supporter — we hit 100%!

SSRF via DNS Rebinding in @abomruseel/can-mcp-server: Incomplete Fix of CVE-2026-53509

More from this source