rewindex

RewindexCVEsDropbox

CVE-2026-81102: Dropbox Dash MCP Server DNS Rebinding via Missing Host Header Validation

Low · CVSS 3.1 (CVSS 3.1)EPSS 0.18%, 8th percentilePublished Updated Assigner: VulnCheck

Description

The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcp_server_dash.py constructed the server for its network mode with the interface restricted to loopback and no transport-security settings, so a name that had been pointed at the loopback address still reached the listener while carrying the attacker's host name. A page in a visitor's browser could therefore drive the local server and invoke its company-search and file-detail tools under the Dropbox credential the server holds. Only the network mode was reachable this way; the standard input mode was not. The fix supplies transport-security settings that enable host checking and allow only the loopback name and port, rejecting other hosts before a tool runs. The repository publishes no versions, so the affected boundary is the commit preceding the fix.

Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N · CWE-346

Tracked companies

Dropbox

Mapped from the CVE’s affected-product data, NVD CPE matches, vendor advisories or package feeds. A mapping means the vendor’s software is named, not that its hosted service was exposed.

Status incidents that name it

No tracked status incident names this CVE.

Affected vendors and products

dropbox: mcp-server-dash

References

All CVEsMarkdownJSON