{"id":"CVE-2026-61546","kind":"vulnerability","aliases":["CVE-2026-61546"],"related":[],"title":"AnkiMCP: DNS rebinding lets web pages reach local Anki collection","description":"AnkiMCP is an Anki addon that implements an MCP server, enabling AI assistants to interact with the Anki flashcard application. Prior to version 0.21.0, `anki_mcp_server/mcp_server.py` globally disables FastMCP DNS-rebinding protection through `TransportSecuritySettings` with `enable_dns_rebinding_protection=False`, including for the default local Streamable HTTP listener. The defaults in `anki_mcp_server/config.py` enable `http_enabled` on `127.0.0.1:3141`, with an empty `http_path` selecting the root endpoint. No bearer token, API key, session secret, strict `Host` allowlist or strict `Origin` allowlist is enforced before `initialize`, `tools/list` and `tools/call` reach MCP dispatch. A victim who visits a malicious web page while Anki and the listener are running can have browser requests rebound to loopback, allowing the attacker to `initialize` MCP, enumerate tools, read the local collection, and perform enabled non-destructive note/deck creation or updates. The attacker needs neither LAN position nor a local process. Available operations depend on enabled tool filters; destructive tools are hidden unless `enabled_destructive_tools` is opted into, limiting deletion-level impact but not the exposed read/write operations. The reported harness confirms real MCP tool dispatch with substituted Anki bridge responses rather than demonstrating destructive changes to a real collection. Disabling protection for tunnels/proxies also disables it for the normal loopback configuration. This issue is fixed in version 0.21.0.","summary":"AnkiMCP is an Anki addon that runs an MCP server on 127.0.0.1:3141 by default, and before 0.21.0 it disabled DNS-rebinding protection. A malicious web page a victim visits while Anki runs can rebind browser requests to loopback and read the local collection or create and update notes and decks through MCP tools.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["anki","ankimcp","desktop","mcp","package","self-hosted"],"not_affected_if":["addon-not-installed","http-listener-disabled","patched-0.21.0-or-later"],"how_to_check":"- Check the installed AnkiMCP addon version in Anki's add-on manager; versions below `0.21.0` are affected.\n- Check `anki_mcp_server/config.py` for `http_enabled` set to true on `127.0.0.1:3141`, which is the default.\n- Check `anki_mcp_server/mcp_server.py` for `enable_dns_rebinding_protection=False`.","fix":"- Update AnkiMCP to `0.21.0` or later.\n- Disable the HTTP listener if it is not needed, or stop Anki while not using AI assistants.","status":"open","published_at":"2026-10-28T22:17:15+00:00","first_seen_at":"2026-10-28T22:35:35+00:00","triaged_at":"2026-10-28T22:36:32+00:00","updated_at":"2026-10-28T22:36:32+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-28T22:36:32Z","model":"claude-haiku-5-5","output":{"fix":"- Update AnkiMCP to `0.21.0` or later.\n- Disable the HTTP listener if it is not needed, or stop Anki while not using AI assistants.","reach":"local","title":"AnkiMCP: DNS rebinding lets web pages reach local Anki collection","impact":"medium","summary":"AnkiMCP is an Anki addon that runs an MCP server on 127.0.0.1:3141 by default, and before 0.21.0 it disabled DNS-rebinding protection. A malicious web page a victim visits while Anki runs can rebind browser requests to loopback and read the local collection or create and update notes and decks through MCP tools.","category":"package","nicknames":[],"who_cares":["anki","ankimcp","mcp","self-hosted","desktop"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker reads and edits the local Anki collection via browser","analyst_note":"","how_to_check":"- Check the installed AnkiMCP addon version in Anki's add-on manager; versions below `0.21.0` are affected.\n- Check `anki_mcp_server/config.py` for `http_enabled` set to true on `127.0.0.1:3141`, which is the default.\n- Check `anki_mcp_server/mcp_server.py` for `enable_dns_rebinding_protection=False`.","needs_analyst":false,"not_affected_if":["patched-0.21.0-or-later","http-listener-disabled","addon-not-installed"],"who_is_affected":"Anyone running the AnkiMCP addon below 0.21.0 with the default HTTP listener enabled while Anki is open. A victim's browser visiting an attacker-controlled page can reach the loopback MCP server; no LAN position or local process is needed. Users who do not have the addon installed, or who run a patched version, are not exposed.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000709,"input_tokens":3760,"output_tokens":666,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-61546':13A,16A '0.21.0':42B,103C,298C '127.0.0.1':36B,140C '3141':37B,141C 'addon':29B,84C 'ai':91C 'allow':197C 'allowlist':160C,164C 'also':284C 'anki':9A,17B,28B,57B,83C,97C,104C,133C,184C,268C 'ankimcp':1A,18B,25B,80C 'api':154C 'applic':99C 'assist':92C 'attack':199C,220C 'avail':229C 'bearer':152C 'bridg':269C 'browser':61B,192C 'chang':275C 'collect':10A,69B,208C,279C 'configur':291C 'confirm':261C 'creat':71B 'creation':216C 'cve':11A,14A 'deck':76B 'default':39B,125C,131C 'delet':249C 'deletion-level':248C 'demonstr':273C 'depend':231C 'desktop':19B 'destruct':214C,236C,242C,274C 'disabl':44B,108C,280C,285C 'dispatch':174C,265C 'dns':2A,46B,111C,118C 'dns-rebind':45B,110C 'empti':144C 'enabl':90C,117C,136C,138C,211C,233C,241C 'endpoint':150C 'enforc':166C 'enumer':203C 'expos':255C 'fals':121C 'fastmcp':109C 'filter':235C 'fix':295C 'flashcard':98C 'global':107C 'har':260C 'hidden':239C 'host':24B,159C 'http':128C,137C,145C 'impact':251C 'implement':86C 'includ':122C 'initi':168C,201C 'interact':94C 'issu':293C 'key':155C 'lan':223C 'let':4A 'level':250C 'limit':247C 'listen':129C,187C 'local':8A,68B,126C,207C,227C 'loopback':64B,196C,290C 'malici':50B,180C 'mcp':20B,33B,78B,88C,105C,134C,173C,202C,263C 'need':221C 'neither':222C 'non':213C 'non-destruct':212C 'normal':289C 'note':74B 'note/deck':215C 'oper':230C,257C 'opt':245C 'origin':163C 'packag':21B 'page':6A,52B,182C 'path':146C 'perform':210C 'posit':224C 'prior':100C 'process':228C 'protect':48B,113C,120C,281C 'rather':271C 'reach':7A,172C 'read':66B,205C 'read/write':256C 'real':262C,278C 'rebind':3A,47B,60B,112C,119C 'rebound':194C 'report':259C 'request':62B,193C 'respons':270C 'root':149C 'run':31B,58B,189C 'secret':157C 'select':147C 'self':23B 'self-host':22B 'server':34B,89C 'server/config.py':135C 'server/mcp_server.py':106C 'session':156C 'streamabl':127C 'strict':158C,162C 'substitut':267C 'token':153C 'tool':79B,204C,234C,237C,243C,264C 'tools/call':171C 'tools/list':169C 'transportsecurityset':115C 'tunnels/proxies':283C 'unless':240C 'updat':73B,218C 'version':102C,297C 'victim':54B,176C 'visit':55B,178C 'web':5A,51B,181C","nicknames":[],"mitigations":[],"who_affected":"Anyone running the AnkiMCP addon below 0.21.0 with the default HTTP listener enabled while Anki is open. A victim's browser visiting an attacker-controlled page can reach the loopback MCP server; no LAN position or local process is needed. Users who do not have the addon installed, or who run a patched version, are not exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T22:17:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61546","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61546","severity":null,"published_at":"2026-10-28T22:17:15+00:00","modified_at":"2026-10-28T22:17:15+00:00","first_seen_at":"2026-10-28T22:35:35+00:00","fetched_at":"2026-10-28T22:35:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}