EUVD-2026-67030
GHSA-37q3-f6jc-625w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconAttacker registers domain with short TTL
-
DeliveryVictim visits attacker-controlled page
-
ExploitDNS record rebound to 127.0.0.1
-
InstallBrowser sends same-origin fetch to local mcp-server-dash port
-
C2Missing Host header check allows request through
-
ExecuteDropbox API tools invoked with stored credential
-
ImpactCompany or file data returned to attacker page
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Origin validation
|
| Exploitation Conditions | Three conditions must be simultaneously true: (1) the victim must be running mcp-server-dash in network mode - the stdio mode opens no socket and is immune; (2) the victim must visit the attacker's page in a browser while mcp-server-dash is active, providing the passive user interaction captured by UI:P in the CVSS 4.0 vector; and (3) a Dropbox credential must be present in the mcp-server-dash environment for tool responses to contain meaningful data. The loopback binding (127.0.0.1) prevents remote TCP connections from external hosts but does not block browser-originated requests on the same machine, which is the core of the rebinding bypass. Exploitation is further limited by the DNS TTL window timing requirement and the need for the victim's browser tab to remain open during the rebind phase. |
| Impact | Real-world risk is constrained by multiple concurrent prerequisites: the victim must run mcp-server-dash in network mode, have a browser session open, and visit an attacker-controlled page during the DNS TTL rebinding window. The CVSS 4.0 AT:P metric (attack target presence) explicitly encodes this dependency, and the resulting score of 2.3 accurately reflects the limited blast radius compared to unconditional network-exploitable flaws. EPSS data is not present in the provided intelligence, and the vulnerability is absent from CISA KEV, so neither an exploitation probability estimate nor confirmed active exploitation is available. The confidentiality impact is bounded by what the mcp-server-dash tools can retrieve - company-search and file-detail results through the Dropbox API - rather than raw credential exfiltration; integrity and availability are unaffected. Despite the low score, any team that deploys mcp-server-dash in network mode with live Dropbox credentials should treat the patch as routine and prompt, because the fix carries no functional trade-offs and the attack surface is entirely eliminated by Host header validation. |
| Exploit ScenarioDerived | An attacker registers a domain with a short DNS TTL, serves a malicious page that loads in the victim's browser, then switches the DNS record to 127.0.0.1 after the initial page load. The victim's browser, treating the domain as same-origin, subsequently issues JavaScript fetch requests that route to the local mcp-server-dash listener - the missing Host header check allows these requests through, and the server executes company-search or file-detail tool calls under the victim's Dropbox credential, returning results to the attacker's page. No public exploit code has been identified at time of analysis, though DNS rebinding toolkits are broadly documented and the technique is well understood. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 27, 2026
DNS rebinding in Dropbox's mcp-server-dash (network mode) allows a malicious web page to reach the local MCP listener and invoke Dropbox API tools - company-search and file-detail - under the victim's stored Dropbox credential. The server bound to the loopback interface but performed no Host header validation, letting a browser issue cross-origin requests via a rebound domain that resolves to 127.0.0.1. No public exploit has been identified at time of analysis; CVSS 4.0 scores this at 2.3, reflecting the attack's prerequisites of user interaction and a specific deployment mode.
RemediationAI
The vendor fix is available via GitHub pull request #12 (https://github.com/dropbox/mcp-server-dash/pull/12); users should update to any commit at or after 84567b74e3c72e42d5e50ee07c56864613f519c2 by pulling the latest revision of the main branch. The fix introduces TransportSecuritySettings with enable_dns_rebinding_protection=True and an allowed_hosts list restricted to 127.0.0.1, localhost, and [::1] on the configured port, rejecting any request whose Host header does not match before a tool is invoked. As an immediate workaround, operators can avoid running mcp-server-dash in network mode entirely and rely on the default stdio transport, which is architecturally immune. If network mode is operationally required before patching, applying a host-based firewall rule to restrict which processes may connect to the listener port reduces the TCP attack surface, but does not address DNS rebinding originating from a browser on the same machine - Host header validation is the only complete mitigation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
mcp-server-dash is Dropbox's Model Context Protocol server implementation, which exposes local tools over an HTTP-based interface when started in network mode. In that mode it binds FastMCP to the loopback address (127.0.0.1) but did not configure TransportSecuritySettings, leaving the Host header unchecked. DNS rebinding exploits this by first resolving an attacker-controlled domain normally, then switching the DNS record to 127.0.0.1 after the TTL expires; the victim's browser subsequently sends same-origin requests carrying the attacker's Host header directly to the local listener, bypassing CORS restrictions. CWE-346 (Origin Validation Error) describes this root cause precisely: the server relied on loopback binding alone to gatekeep access without verifying that the Host header named a loopback identifier. The stdio transport mode (the default) is architecturally immune because it does not open a network socket. The CPE cpe:2.3:a:dropbox:mcp-server-dash:*:*:*:*:*:*:*:* reflects that all revisions of the project before the fix commit are affected.
Know when Dropbox gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
DNS rebinding requires a timing-dependent TTL window (AC:H); victim must actively visit attacker page (UI:R); impact limited to low confidentiality via constrained Dropbox API read access.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcp_server_dash.py constructed the server for its network mode with the interface restricted to loopback and no transport-security settings, so a name that had been pointed at the loopback address still reached the listener while carrying the attacker's host name. A page in a visitor's browser could therefore drive the local server and invoke its company-search and file-detail tools under the Dropbox credential the server holds. Only the network mode was reachable this way; the standard input mode was not. The fix supplies transport-security settings that enable host checking and allow only the loopback name and port, rejecting other hosts before a tool runs. The repository publishes no versions, so the affected boundary is the commit preceding the fix.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Dropbox Lepton v1.2.1-185-g2a08b77 was discovered to contain a heap-buffer-overflow in the function aligned_dealloc():sr
Dropbox.exe (and QtWebEngineProcess.exe in the Web Helper) in the Dropbox desktop application 71.4.108.0 store cleartext
In the Samly package before 1.4.0 for Elixir, Samly.State.Store.get_assertion/3 can return an expired session, which int
A vulnerability was found in Dropbox merou. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitab
The allocate_channel_framebuffer function in uncompressed_components.hh in Dropbox Lepton 1.2.1 allows remote attackers
An issue was discovered in Dropbox Lepton 1.2.1. Rated medium severity (CVSS 5.5), this vulnerability is no authenticati
Authentication bypass via SAML assertion replay affects Samly, the Elixir/Plug SAML 2.0 Service Provider library from Dr
Dropbox Desktop Folder Sharing Mark-of-the-Web Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability
Unauthenticated memory exhaustion in the Erlang esaml SAML library (version 0.1.0 and later) lets a remote attacker cras
Unauthenticated remote denial of service in the Erlang SAML library esaml (0.1.0 and later) allows an attacker to abort
Authentication bypass in the Elixir SAML library samly (v0.3.0+) allows an attacker holding a validly IdP-signed SAML as
Dropbox SDK for Android before 1.6.2 might allow remote attackers to obtain sensitive information via crafted malware or
Exploit-DB