AnkiMCP Server CVE-2026-61546

Exploitation requires the AnkiMCP addon's default Streamable HTTP listener to be running (http_enabled=True on 127.0.0.1:3141 with empty http_path selecting the root endpoint) while Anki is open, and the victim must visit an attacker-controlled page that performs DNS rebinding to loopback (UI:P). No LAN position, local process, bearer token, API key, session secret, or Host/Origin allowlist is needed because protection is globally disabled before initialize/tools/list/tools/call reach MCP dispatch. Limiting factors that reduce realistic risk: the attacker depends on successful rebinding and timing (AT:P) and on the victim actively browsing while the listener is live; available operations are bounded by enabled tool filters, and destructive/deletion tools are hidden unless the user opts into enabled_destructive_tools - so default impact is read plus non-destructive note/deck create/update, not deletion, though confidentiality and integrity of the collection are still exposed.

Multiple signals point to a genuine but conditional risk rather than a mass-exploitation emergency. The CVSS 4.0 base is 8.8 (High) with AV:N, AC:L, PR:N and high vulnerable- and subsequent-system confidentiality/integrity impact (VC:H/VI:H/SC:H/SI:H), reflecting that a remote, unauthenticated web page can reach the loopback MCP listener and both read and modify the local Anki collection. However, two de-rating metrics matter: AT:P (a specific attack requirement - successful DNS rebinding plus the victim running Anki with the listener active) and UI:P (the victim must visit the attacker's page), so exploitation is not fully attacker-automatable and depends on victim-side timing and configuration. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a prioritized-but-not-drop-everything fix. CISA KEV status is NO (no confirmed active exploitation), and no EPSS score was supplied, so widespread-exploitation probability cannot be quantified from the input - this gap should be noted rather than assumed low. A detailed public PoC is published in the GHSA advisory; it exercises the real McpServer, real FastMCP construction, real Streamable HTTP transport and real tool registration, but substitutes the Anki main-thread bridge response, so it confirms end-to-end MCP dispatch under forged Host/Origin headers rather than demonstrating changes to a real collection. Net: a real priority worth patching promptly, tempered by the niche footprint of the affected addon and the victim-interaction/timing prerequisites that make opportunistic mass exploitation less likely than the raw 8.8 suggests.

A user runs Anki with the AnkiMCP addon, whose default local HTTP MCP listener is active on 127.0.0.1:3141 at the root path. While that listener is running, the user visits an attacker-controlled web page, which uses DNS rebinding to make its hostname resolve to loopback; because the addon globally disables FastMCP DNS-rebinding protection and enforces no bearer token, session secret, or strict Host/Origin allowlist, the browser's requests complete MCP initialize, list Anki tools, and invoke read and non-destructive write tools against the local collection. A working public PoC in the advisory confirms this MCP dispatch path (with a substituted Anki bridge response); attack complexity is low but the attack requires the victim to visit the page (UI:P) and depends on rebinding/timing conditions (AT:P).