DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-55637: CVE-2026-55637: Remote Administrative Command Execution in genieacs-mcp via DNS Rebinding

#security #cve #cybersecurity

CVE-2026-55637: Remote Administrative Command Execution in genieacs-mcp via DNS Rebinding

Vulnerability ID: CVE-2026-55637
CVSS Score: 8.8
Published: 2026-08-25

CVE-2026-55637 is a high-severity DNS rebinding vulnerability affecting the genieacs-mcp Model Context Protocol server. Prior to version 0.3.2, the application's Streamable HTTP transport lacks adequate Host and Origin header validation. This omission allows external attackers to bypass the Same-Origin Policy through a victim's browser and issue unauthenticated commands to loopback listeners.

TL;DR

Unauthenticated loopback HTTP transport in genieacs-mcp prior to 0.3.2 fails to validate Host and Origin headers, enabling remote attackers to bypass the Same-Origin Policy via DNS rebinding and compromise GenieACS administration.

Technical Details

  • CWE ID: CWE-346 (Origin Validation Error)
  • Attack Vector: Network / Browser-Driven DNS Rebinding
  • CVSS v4.0 Score: 8.8 (High)
  • Exploit Status: Proof of Concept
  • CISA KEV Status: Not Listed
  • Remediation Status: Patched in v0.3.2

Affected Systems

  • genieacs-mcp
  • genieacs-mcp: < 0.3.2 (Fixed in: 0.3.2)

Code Analysis

Commit: 577306d

Fix DNS rebinding vulnerability by validating Host and Origin headers with dnsRebindGuard middleware.

Commit: bcb91f1

Mandate the presence of MCP_AUTH_TOKEN ONLY if MCP_LISTEN_ADDR is set to a non-loopback address.

Commit: 8d7d343

Initial hardening, NoSQL injection remediation in query builders, and default to 127.0.0.1 bind address.

Mitigation Strategies

  • Upgrade to genieacs-mcp v0.3.2 or higher.
  • Disable the HTTP network listener by setting TRANSPORT=stdio.
  • Enforce mandatory authorization across loopback interfaces by configuring MCP_AUTH_TOKEN.
  • Define strict domain restrictions using MCP_ALLOWED_HOSTS and MCP_ALLOWED_ORIGINS environment variables.

Remediation Steps:

  1. Access the local deployment configuration files for the genieacs-mcp application.
  2. Modify the configuration or Docker-compose environment variables to update the container version to v0.3.2.
  3. If immediate upgrade is unfeasible, add TRANSPORT=stdio to the system's environment properties.
  4. Generate and configure a robust token under MCP_AUTH_TOKEN to require authenticated interactions.

References

Read the full report for CVE-2026-55637 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)