CVE-2026-11624

Descripción

The Model Context Protocol has a security warning advising servers to validate the -Origin- header on all incoming connections to prevent DNS rebinding attacks. Prior to the v0.25.0 release, users had no way to validate the origin-s host. In v0.25.0, a new ---allowed-hosts- flag was introduced alongside the existing ---allowed-origins- flag, enabling users to specify permitted hosts at server startup. Both flags default to -*-, allowing users to implement strict access controls as needed without breaking existing setups. If either flag is set to -*-, the server will output a startup warning about potential vulnerabilities. Documentation has also been updated to highlight these security considerations.