AnkiMCP inadvertently disables DNS‑rebinding protection for its default HTTP listener, allowing a browser to redirect requests back to the local machine. This flaw enables an attacker to call the MCP initialize, enumerate tools, and read the local Anki collection without authentication. The attacker can also create or update notes and decks if those tools are enabled, though destructive operations remain hidden unless explicitly opted into. The vulnerability does not require a LAN position or a running local process; it is exploitable merely by visiting a malicious webpage while the victim’s Anki and MCP server are active.

The affected product is the AnkiMCP add‑on for Anki, specifically the anki-mcp-server-addon version earlier than 0.21.0. The software runs a Streamable HTTP listener on 127.0.0.1:3141 with default settings that expose the tools over the root endpoint.

With a CVSS score of 8.8 the issue is classified as high severity. The EPSS score is currently unavailable, but the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. An attacker can achieve the vulnerability by embedding malicious content in a webpage and simply visiting it while the victim is running Anki. No additional privileges or network access are needed; the exploit relies solely on DNS rebinding to the loopback interface. Once accessed, an attacker gains read access to the user's collection and the ability to add or modify entries, which can be significant for privacy and integrity.