CVE-2026-61546

AnkiMCP's local HTTP listener accepts DNS-rebound browser requests

AnkiMCP · anki-mcp-server-addon local HTTP transport

First documented disclosure · Review checkpoint

Summary

A malicious page can reach local collection tools while Anki is running.

Severity and exploitation evidence

High · 8.8/10 · CVSS 4.0. Severity source.

Exploitation not established: A controlled test uses the actual MCP server/transport with substituted Anki bridge responses and demonstrates dispatch. It does not prove destructive operations on a real victim collection.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The addon disables FastMCP's DNS-rebinding protection and accepts attacker-controlled Host/Origin headers without a per-request secret.

Conditions required

Anki with its HTTP listener enabled and a user visiting attacker-controlled content capable of DNS rebinding.

Potential impact

Read or modify the Anki collection through enabled tools. Destructive tools are hidden by default unless explicitly enabled.

Affected versions and configurations

Versions through 0.20.0.

Fix and mitigation status

0.21.0 enables Host/Origin protection; optional API-key authentication is available but disabled by default.

Practical next steps

Upgrade; retain DNS-rebinding checks, configure narrow tunnel allowlists and enable a per-request API key where appropriate.

Operating lesson

A loopback address alone does not authenticate a browser-origin request.

Evidence and limits

The original advisory and fixed release were public June 18; the CNA appeared October 28. The tested bridge was stubbed and tool-filter limits remain important. The WebSocket tunnel transport is not the affected HTTP path.

Sources