Apollo MCP Server versions before 1.7.0 fail to validate the Host header on incoming HTTP requests when using the StreamableHTTP transport mode. This lack of validation can be exploited via DNS rebinding attacks if the server is running locally without authentication or network restrictions, enabling a malicious website visited by the user to send unauthorized requests to the local MCP server. The vulnerability does not affect stdio transport and is mitigated by authentication or network-level controls. The issue is addressed in version 1.7.0.

Successful exploitation could allow an attacker to invoke tools or access resources exposed by the local MCP server on behalf of the user. The impact includes potential unauthorized command execution or data access with the privileges of the local user running the server. The risk is reduced if authentication, network controls, or non-localhost bindings are in place. The CVSS v3.1 score is 6.8 (medium severity), reflecting network attack vector with high impact on confidentiality and integrity but requiring user interaction and high attack complexity.

Upgrade apollo-mcp-server to version 1.7.0 or later, where the Host header validation issue is fixed. If upgrading is not immediately possible, ensure that the MCP server is not exposed without authentication or network-level access controls, and avoid running the HTTP-based MCP server on localhost in insecure environments. Since no official patch link or advisory is provided, check the vendor's official channels for the latest updates and confirm remediation status.