MCP Ruby SDK EUVD-2026-50489

Exploitation requires two simultaneous conditions: the victim must be running an MCP Ruby SDK server (StreamableHTTPTransport, pre-0.23.0) locally, and the victim must visit an attacker-controlled webpage in a browser capable of performing DNS rebinding. The attack is strictly browser-mediated - non-browser MCP clients that do not send an HTTP Origin header are explicitly unaffected, as the validate_origin method exempts Origin-less requests. User interaction (UI:A) is mandatory; the victim must navigate to the malicious page and remain there while the DNS TTL expires and rebinding occurs. The AT:P prerequisite reflects that the attacker must control a domain with a very short TTL and coordinate the rebinding timing. Exploitation is bounded by the tools the victim has registered on the MCP server - servers exposing only low-sensitivity tools carry proportionally lower actual risk despite the same CVSS score. No authentication to the MCP server is required once the rebinding succeeds.

The CVSS 4.0 vector (6.9: AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N) accurately reflects two real constraints: AT:P (attack prerequisites - a locally running MCP server must be present) and UI:A (victim must visit the attacker's page). These conditions frequently co-occur in developer workflows, where AI-integrated tooling runs alongside normal web browsing, making the theoretical risk quite concrete for the affected user population. Confidentiality impact is rated High on both the vulnerable system and the subsequent system (VC:H, SC:H), acknowledging that MCP tools frequently expose filesystem access, AI context windows, credentials, or internal APIs. No EPSS data was provided in the input, preventing quantitative exploitation probability assessment. No CISA KEV listing exists, and no public POC has been identified at time of analysis. Despite a moderate numeric score, the realistic cohort of affected users (Ruby developers with active local MCP servers) and the sensitivity of what MCP tools typically expose elevate practical risk above the score alone implies for that specific population. The attack does not require any authenticated access to the MCP server - the missing header validation is the sole barrier bypassed.

An attacker registers a domain with a very short TTL, serves a malicious JavaScript payload, and waits for a developer running a local MCP Ruby SDK server to visit the page. After the browser caches the initial DNS response, the attacker flips the domain's A record to 127.0.0.1; subsequent fetch calls from the still-open page are routed to the local MCP endpoint, which - lacking Host or Origin validation - services them. The attacker's JavaScript can enumerate and invoke any registered MCP tool, returning results (file contents, credentials, AI context) directly to the attacker's origin. No public exploit code has been identified at time of analysis.