CVE-2026-81102: Origin Validation Error in dropbox mcp-server-dash

The Dash MCP server in Dropbox's mcp-server-dash component bound its listener to the loopback address but failed to validate the host name of requests. This allowed requests with an attacker-controlled host name pointed at the loopback address to reach the listener and invoke sensitive tools using the server's Dropbox credentials. The vulnerability was limited to the network mode of the server. The remediation added transport-security settings to enforce host checking, allowing only the loopback host and port and rejecting others before tool execution. The affected boundary is the commit before this fix, as no versions are published.

An attacker could craft a web page that, when visited by a user, could interact with the local Dash MCP server's network mode and invoke company-search and file-detail tools using the server's Dropbox credentials. This could lead to unauthorized access to company data accessible via these tools. However, the vulnerability requires user interaction (UI) and has a low CVSS score, indicating limited impact and exploitability.

The vulnerability has been fixed by adding transport-security settings that enforce host name validation, restricting access to only the loopback name and port. Since no versions are published, the fix is applied at the commit level. Users should update to the fixed commit or apply the patch that introduces these transport-security settings. No additional mitigation is indicated.