CVE-2026-63118 MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection
Attackers can use DNS rebinding to access local MCP servers and invoke tools due to missing Host/Origin validation in the Ruby SDK.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-63118?
CVE-2026-63118 is a medium-severity server-side request forgery vulnerability in modelcontextprotocol ruby-sdk, published on 29 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not validate the HTTP Host or Origin request headers, which allows a malicious browser page to use DNS rebinding to reach a locally running MCP server and invoke exposed tools. This issue is fixed in version 0.23.0.
Which versions are affected by CVE-2026-63118?
2 open source packages ship an affected version, including mcp.
| Package | Affected | Fixed in |
|---|---|---|
mcp RubyGems | All versions | 0.23.0 |
mcp RubyGems | All versions | 0.23.0 |
How do I fix CVE-2026-63118?
Upgrade mcp to 0.23.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-63118 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-63118 exists.
Sources
Also known as GHSA-rjr6-rcgv-9m7m.