CVE-2026-61546 in Anki Mcp Server Addon
Summary
by MITRE • 10/28/2026
AnkiMCP is an Anki addon that implements an MCP server, enabling AI assistants to interact with the Anki flashcard application. Prior to version 0.21.0, `anki_mcp_server/mcp_server.py` globally disables FastMCP DNS-rebinding protection through `TransportSecuritySettings` with `enable_dns_rebinding_protection=False`, including for the default local Streamable HTTP listener. The defaults in `anki_mcp_server/config.py` enable `http_enabled` on `127.0.0.1:3141`, with an empty `http_path` selecting the root endpoint. No bearer token, API key, session secret, strict `Host` allowlist or strict `Origin` allowlist is enforced before `initialize`, `tools/list` and `tools/call` reach MCP dispatch. A victim who visits a malicious web page while Anki and the listener are running can have browser requests rebound to loopback, allowing the attacker to `initialize` MCP, enumerate tools, read the local collection, and perform enabled non-destructive note/deck creation or updates. The attacker needs neither LAN position nor a local process. Available operations depend on enabled tool filters; destructive tools are hidden unless `enabled_destructive_tools` is opted into, limiting deletion-level impact but not the exposed read/write operations. The reported harness confirms real MCP tool dispatch with substituted Anki bridge responses rather than demonstrating destructive changes to a real collection. Disabling protection for tunnels/proxies also disables it for the normal loopback configuration. This issue is fixed in version 0.21.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in AnkiMCP prior to version 0.21.0 represents a critical misconfiguration of transport security settings that exposes local application interfaces to remote code execution and data exfiltration via cross-site request forgery mechanisms. The core technical flaw lies in the global disabling of DNS rebinding protection within the FastMCP server implementation, specifically through the TransportSecuritySettings configuration where enable_dns_rebinding_protection is set to False. This setting applies uniformly across all transport types, including the default local Streamable HTTP listener bound to 127.0.0.1 on port 3141. By disabling this protection, the server fails to validate that incoming requests originate from trusted sources or legitimate loopback connections, thereby allowing malicious web pages hosted on external domains to successfully bind their DNS resolution to localhost addresses during request transmission.
The operational impact of this vulnerability is severe due to the lack of authentication and origin validation mechanisms in the pre-initialization phase of the MCP protocol handshake. The default configuration enables HTTP access with an empty path that selects the root endpoint, exposing critical initialization endpoints without requiring any bearer tokens, API keys, session secrets, or strict Host and Origin allowlists. Consequently, an attacker who can induce a victim to visit a malicious web page while AnkiMCP is running can exploit browser-based DNS rebinding techniques to bypass same-origin policies. This allows the attacker's script to send HTTP requests that appear to originate from localhost, effectively tricking the server into processing commands as if they were coming from a trusted local client or administrator interface.
Once the initial connection is established through this rebinding attack, the attacker gains full access to the MCP tool dispatch system without authentication. The vulnerability allows for the enumeration of available tools via the tools/list endpoint and subsequent execution of those tools using tools/call. Depending on the specific configuration of enabled tool filters, an attacker can read sensitive data from the local Anki collection, including flashcard content, user notes, and deck structures. Furthermore, if non-destructive operations are permitted by the active filter settings, the attacker can create new decks or modify existing note attributes. While destructive tools such as deletion commands are typically hidden unless explicitly opted into via enabled_destructive_tools configurations, this limitation does not mitigate the risk of unauthorized data access or modification of study materials, which constitutes a significant breach of confidentiality and integrity for users relying on Anki for educational purposes.
This vulnerability aligns with CWE-295 Improper Certificate Validation in the context of missing origin checks and CWE-346 Origin Error When Using Cross-Site Request Forgery Prevention Mechanisms that are not enforced before authentication or authorization decisions. In terms of MITRE ATT&CK, this scenario maps to T1078 Valid Accounts if we consider the bypassed local service as a trusted entity, but more accurately reflects T1556 Modification of Client/Server Authentication and potentially T1041 Exfiltration Over C2 Channel when data is sent out from the victim's machine. The attack vector requires no special network position such as LAN access nor does it require running a local process on the victim's machine, relying instead on standard web browser capabilities to perform DNS rebinding against localhost interfaces that lack proper security controls.
Mitigation for this vulnerability involves upgrading AnkiMCP to version 0.21.0 or later where these transport security defaults have been corrected. In the interim, users should ensure that the MCP server is not running when browsing untrusted websites, as there are no effective client-side mitigations available due to the fundamental design flaw in how the server handles incoming connections from loopback addresses. Administrators and developers integrating similar AI-assisted tools with local applications must strictly enforce origin validation, implement mandatory authentication mechanisms such as bearer tokens or API keys for all endpoints including initialization sequences, and maintain strict Host allowlists to prevent DNS rebinding attacks. It is also critical to review tool filter configurations to ensure that only necessary operations are exposed and that destructive capabilities remain disabled by default unless explicitly required for specific administrative tasks under controlled conditions.