AnkiMCP: DNS rebinding exposes unauthenticated local MCP HTTP tools
Summary
AnkiMCP, an Anki add-on that runs an MCP server for AI assistants, disables DNS-rebinding protection for its local HTTP listener on 127.0.0.1:3141 by default. A malicious web page visited while Anki and the listener are running can use DNS rebinding to send requests to loopback without any authentication. The attacker can then read the local collection and create or update enabled notes and decks; destructive tools stay hidden unless explicitly enabled.
Affected
- ankimcp anki-mcp-server-addon versions prior to 0.21.0
- Default configuration with the HTTP listener enabled (127.0.0.1:3141)
Fixed in
- Version 0.21.0 (vendor fix; commits 6dcb6939b0ecc0801f45cf0d241dc946aad1654f and d5306ff42d68f1e3b82a96878eb059437e820316)
Workaround
- Disable the add-on's HTTP listener when it is not needed
- Close Anki when the MCP server is not in use
- No vendor workaround is known for unpatched versions
Exploitation
- CISA SSVC: exploitation status PoC, not automatable
- The reported proof of concept used substituted Anki bridge responses, not a real collection
- No known active exploitation at the time of research
Our recommendation
- Update AnkiMCP to version 0.21.0 or later on all workstations where Anki is used
- Disable the HTTP listener or quit Anki when the add-on is not needed
- After upgrading, re-add any tunnel or proxy hostnames through the allowed hosts and origins settings
- Review the enabled tool filters and keep destructive tools disabled
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fix commit 6dcb693 (DNS-rebinding protection) github.com
- Fix commit d5306ff (HTTP API key auth) github.com
- GitHub Security Advisory GHSA-j9xx-59ph-wmr6 github.com
- Release tag v0.21.0 github.com
- VulDB entry CVE-2026-61546 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:24.
Original description (NVD)
AnkiMCP is an Anki addon that implements an MCP server, enabling AI assistants to interact with the Anki flashcard application. Prior to version 0.21.0, `anki_mcp_server/mcp_server.py` globally disables FastMCP DNS-rebinding protection through `TransportSecuritySettings` with `enable_dns_rebinding_protection=False`, including for the default local Streamable HTTP listener. The defaults in `anki_mcp_server/config.py` enable `http_enabled` on `127.0.0.1:3141`, with an empty `http_path` selecting the root endpoint. No bearer token, API key, session secret, strict `Host` allowlist or strict `Origin` allowlist is enforced before `initialize`, `tools/list` and `tools/call` reach MCP dispatch. A victim who visits a malicious web page while Anki and the listener are running can have browser requests rebound to loopback, allowing the attacker to `initialize` MCP, enumerate tools, read the local collection, and perform enabled non-destructive note/deck creation or updates. The attacker needs neither LAN position nor a local process. Available operations depend on enabled tool filters; destructive tools are hidden unless `enabled_destructive_tools` is opted into, limiting deletion-level impact but not the exposed read/write operations. The reported harness confirms real MCP tool dispatch with substituted Anki bridge responses rather than demonstrating destructive changes to a real collection. Disabling protection for tunnels/proxies also disables it for the normal loopback configuration. This issue is fixed in version 0.21.0.
NVD references (5)
- https://github.com/ankimcp/anki-mcp-server-addon/commit/6dcb6939b0ecc0801f45cf0d241dc946aad1654f
- https://github.com/ankimcp/anki-mcp-server-addon/commit/d5306ff42d68f1e3b82a96878eb059437e820316
- https://github.com/ankimcp/anki-mcp-server-addon/security/advisories/GHSA-j9xx-59ph-wmr6
- https://github.com/ankimcp/anki-mcp-server-addon/tree/v0.21.0
- https://github.com/ankimcp/anki-mcp-server-addon/security/advisories/GHSA-j9xx-59ph-wmr6
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.