The Model Context Protocol (MCP) Toolbox for Databases had a security weakness where servers were advised to validate the "Origin" header on incoming connections to prevent DNS rebinding attacks. Before v0.25.0, users could not restrict allowed origins or hosts, leaving the server vulnerable. The release of v0.25.0 added the "--allowed-hosts" flag to complement the "--allowed-origins" flag, allowing users to specify permitted hosts at startup. Both flags default to "*", which means no restriction unless explicitly configured, and the server warns users if this default is used. This vulnerability is classified under CWE-346 (Origin Validation Error) and has a CVSS 4.0 score of 9.4, indicating critical severity.

Without proper origin validation, the MCP Toolbox server is susceptible to DNS rebinding attacks, which can allow attackers to bypass same-origin policies and potentially access or manipulate internal resources. The lack of origin host validation prior to v0.25.0 means that servers running earlier versions are exposed to this risk. The introduction of configuration flags in v0.25.0 mitigates this by enabling administrators to restrict allowed origins and hosts, reducing the attack surface.

Users should upgrade to version 0.25.0 or later, which introduces the "--allowed-hosts" and "--allowed-origins" flags to control access based on origin headers. Administrators must configure these flags to specify permitted hosts and origins explicitly rather than relying on the default "*" wildcard. The server issues a startup warning if either flag is set to "*", indicating potential vulnerability. Follow the updated documentation to implement strict access controls and prevent DNS rebinding attacks. Since no official patch beyond this configuration change is indicated, proper flag configuration is the primary mitigation.