The vulnerability arises from the absence of Host header validation on HTTP requests received by certain transports of Apollo MCP Server. This oversight permits a malicious site to craft requests with a forged Host header, enabling DNS rebinding attacks that circumvent same-origin policy limitations. An attacker exploiting this flaw can invoke GraphQL‑based tools or access other resources that the local MCP server exposes, effectively performing actions on behalf of the local user. The weakness aligns with CWE‑346, which focuses on lack of input validation for request headers.

Apollo MCP Server deployments running the StreamableHTTP transport before version 1.7.0 and bound to localhost without additional authentication or network‑level controls are affected. Servers employing the stdio transport are not impacted, nor are those using authentication or external access restrictions.

The CVSS score of 6.8 indicates a moderate risk level; EPSS data is not available and the vulnerability is not listed in the KEV catalog. Exploitation requires that a user visits a malicious website while the MCP server is running locally, leveraging DNS rebinding to supply a forged Host header. With the attacker’s ability to execute tools or retrieve resources locally, the impact could be significant for confidentiality, integrity, and availability of data or processes exposed by the MCP server. Deployments that restrict network interfaces or enforce authentication significantly reduce exploitable surface area.