The Dash MCP server is bound to the loopback interface but fails to validate the Host header in incoming HTTP requests. This omission allows an attacker to craft a DNS rebinding attack that resolves a domain name to the loopback address. A web page loaded in the victim's browser can then send properly formed requests carrying the attacker's host name to the local server, triggering its company‑search and file‑detail utilities under the Dropbox credentials that the server maintains. Because the server accepts these requests unconditionally, the attacker can effectively read or enumerate the server's data without needing credentials.

The affected software is Dropbox's MCP server Dash, isolated to the repository code before the fix. No released versions are published, so any deployment compiled from the commit preceding the patch is vulnerable. The flaw impacts only the network mode, not the standard input mode.

The CVSS score is 2.3, indicating a low overall risk. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the target runs the vulnerable MCP server in network mode and that the attacker can host a web page causing the victim's browser to issue requests to the loopback interface. The lack of host validation permits an adversary to indirectly invoke privileged server functions, resulting in limited but potentially sensitive data exposure. The remediation path is to apply the official patch that introduces transport‑security settings enforcing host header validation.