CVE-2026-11624 Newest CVEs from Tenable / 9h Critical Severity Description The Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent DNS rebinding attacks. Prior to the v0.25.0 release, users had no way to validate the origin's host. In v0.25.0, a new "--allowed-hosts" flag was introduced alongside the existing "--allowed-origins" flag, enabling users to specify permitted hosts at server startup. Both flags default t

www.tenable.com • June 14, 2026

The Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent DNS rebinding attacks. Prior to the v0.25.0 release, users had no way to validate the origin's host. In v0.25.0, a new "--allowed-hosts" flag was introduced alongside the existing "--allowed-origins" flag, enabling users to specify permitted hosts at server startup. Both flags default to "*", allowing users to implement strict access controls as needed without breaking existing setups. If either flag is set to "*", the server will output a startup warning potential vulnerabilities. Documentation has also been updated to highlight these security considerations.

Published : 2026-06-13

Vector : CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

Vector : CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Vector : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical CVE-2026-11624 Vulnerability in Model Context Protocol CVE-2026-11624, published on June 13, 2026, exposes the Model Context Protocol to DNS rebinding attacks due to improper validation of the 'Origin' header. This vulnerability allows unauthenticated attackers to bypass origin validation, potentially leading to unauthorized access to server functionalities and data. The CVSS base score is 9.4, indicating critical severity. Users are advised to upgrade to version 0.25.0 or later, which introduces the '--allowed-hosts' and '--allowed-origins' flags for enhanced security. If these flags are set to '*', a startup warning will be issued, indicating potential vulnerabilities. Currently, there is no public proof-of-concept or evidence of active exploitation. Organizations using affected versions are at risk until they implement the necessary updates. 3 sources 78

Extracted Entities

Attack Types (1)

DNS Rebinding

CVEs (1)

CVE-2026-11624