Anki Mcp Server Addon
Monthly
AnkiMCP Server addon 0.20.0 and earlier ships a FastMCP Streamable HTTP listener enabled by default on 127.0.0.1:3141 with DNS-rebinding protection globally disabled, so a malicious web page that rebinds a hostname to loopback can complete MCP `initialize`, enumerate tools with `tools/list`, and dispatch `tools/call` against the victim's Anki collection without any bearer token, API key, session secret, or Host/Origin allowlist check. Because the flaw needs the victim to browse an attacker-controlled page while Anki and the listener are live, and depends on successful rebinding and timing (CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:C), the practical window is conditional rather than continuous; the vendor GHSA includes a reproduction harness that reaches real MCP tool dispatch with substituted Anki bridge responses, but it is not verified as working exploit code that modifies a real collection. There is no CISA KEV entry and no confirmed active exploitation at time of analysis; default impact is unauthorised read of the collection plus non-destructive note/deck creation and updates, since destructive tools stay hidden unless `enabled_destructive_tools` is opted into.
AnkiMCP Server addon 0.20.0 and earlier ships a FastMCP Streamable HTTP listener enabled by default on 127.0.0.1:3141 with DNS-rebinding protection globally disabled, so a malicious web page that rebinds a hostname to loopback can complete MCP `initialize`, enumerate tools with `tools/list`, and dispatch `tools/call` against the victim's Anki collection without any bearer token, API key, session secret, or Host/Origin allowlist check. Because the flaw needs the victim to browse an attacker-controlled page while Anki and the listener are live, and depends on successful rebinding and timing (CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:C), the practical window is conditional rather than continuous; the vendor GHSA includes a reproduction harness that reaches real MCP tool dispatch with substituted Anki bridge responses, but it is not verified as working exploit code that modifies a real collection. There is no CISA KEV entry and no confirmed active exploitation at time of analysis; default impact is unauthorised read of the collection plus non-destructive note/deck creation and updates, since destructive tools stay hidden unless `enabled_destructive_tools` is opted into.