CVE-2026-11624 INCIBE-CERT - Vulnerabilities RSS / 15h The Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent DNS rebinding attacks. If either flag is set to "*", the server will output a startup warning about potential vulnerabilities.

www.incibe.es • June 14, 2026

Puntuación base: 9.40 CRÍTICA Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Vector de acceso (AV): A través de red Complejidad de acceso (AC): Bajo Attack Requirements (AT): Ninguno Privilegios Requeridos (PR): Ninguno Interacción del usuario (UI): Activo Confidentiality (VC): Alto Integrity (VI): Alto Availability (VA): Alto Confidentiality (SC): Alto Integrity (SI): Alto Availability (SA): Alto

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical CVE-2026-11624 Vulnerability in Model Context Protocol CVE-2026-11624, published on June 13, 2026, exposes the Model Context Protocol to DNS rebinding attacks due to improper validation of the 'Origin' header. This vulnerability allows unauthenticated attackers to bypass origin validation, potentially leading to unauthorized access to server functionalities and data. The CVSS base score is 9.4, indicating critical severity. Users are advised to upgrade to version 0.25.0 or later, which introduces the '--allowed-hosts' and '--allowed-origins' flags for enhanced security. If these flags are set to '*', a startup warning will be issued, indicating potential vulnerabilities. Currently, there is no public proof-of-concept or evidence of active exploitation. Organizations using affected versions are at risk until they implement the necessary updates. 3 sources 78

Extracted Entities

Attack Types (1)

DNS Rebinding

CVEs (1)

CVE-2026-11624