The Model Context Protocol (MCP) did not validate the Origin header on incoming connections before version 0.25.0, which creates a risk of DNS rebinding attacks. In a DNS rebinding scenario, a malicious site can alternate DNS responses to trick the MCP server into thinking requests come from a trusted origin, thereby bypassing same‑origin restrictions. This flaw is categorized as CWE‑346, representing improper origin validation. The absence of host verification may allow attackers to connect to the server from untrusted domains and potentially exfiltrate data or perform unauthorized operations.

All installations of Google MCP Toolbox for Databases that are older than v0.25.0 are affected. The vulnerability arises because the tool defaults to allowing all origins and hosts until the user explicitly configures restrictions via the --allowed-hosts or --allowed-origins flags. The new flags were only introduced in the v0.25.0 release, making all earlier releases susceptible to this issue.

The CVSS score of 9.4 indicates a high severity, reflecting a high impact and high exploitation likelihood via the network. No EPSS score is available, which means the historical exploitation probability is unknown, but the lack of validation combined with the default wildcard configuration makes exploitation straightforward for remote attackers who can direct traffic to the MCP server. The vulnerability is not listed in the CISA KEV catalog, implying no publicly available exploit remains in circulation, yet the inherent weakness still poses a serious risk for environments that rely on the MCP server to enforce origin constraints.