Dinhvaren

The MCP HTTP-stream transport is exposed without authentication by default because the CLI `--api-key` option defaults to `None`, and the server only enforces Authorization/Bearer checks when an API key is configured. An unauthenticated client can initialize a session, enumerate available tools via the `tools/list` endpoint, and invoke tools via the `tools/call` endpoint. Furthermore, the dispatcher forwards tool-call arguments to handlers without validating them against the `inputSchema`. While the server binds to 127.0.0.1 by default, remote exploitation is possible if the operator binds the server to a network-accessible address using the `--host` parameter.

A server-side request forgery (SSRF) issue exists in the `web crawl` tool. The software validates hostnames at check time using the ` is safe crawl url()` function to reject private, loopback, or link-local IPs, but it does not pin the resolved IP. Consequently, the backend re-resolves the hostname at connection time. An attacker can use DNS rebinding—a technique where a domain returns a public IP during validation and an internal IP during the actual fetch—to bypass these protections. This allows the retrieval of internal HTTP response bodies from private or loopback services. The issue affects multiple backends, including `httpx`, `urllib`, and `crawl4ai` (headless Chromium). Specifically, the ` crawl with httpx()` function and the `web crawl` tool are affected.

The software has an insecure default configuration that binds to all network interfaces, lacks API key requirements, and uses wildcard CORS (Cross-Origin Resource Sharing), which allows resources to be requested from any domain. Unauthenticated attackers can access the 'GET /api/agents' endpoint to read agent instructions and system prompts, or use the 'POST /api/chat' endpoint to invoke agents.

The software lacks signature verification when operating in webhook mode. This allows unauthenticated attackers to inject messages with spoofed sender addresses by sending crafted `message.received` events to the webhook endpoint. This action enables the injection of arbitrary content into the agent and can trigger replies to addresses controlled by the attacker, effectively bypassing sender allow and block lists.

A server-side request forgery (SSRF) issue exists in the Crawl4AI/Chromium backend. This flaw allows attackers to bypass SSRF validation by utilizing DNS rebinding and HTTP redirects. By crafting specific URLs that resolve to internal services after the initial validation, an attacker can force the headless browser to follow redirects and read internal responses, which may include sensitive canary values.

An unauthenticated server-side request forgery (SSRF) exists in the Jobs API endpoint '/api/v1/runs'. The issue occurs because the `webhook url` parameter is validated during the initial request but re-resolved during the connection phase. This allows attackers to employ DNS rebinding—a technique used to bypass security filters by changing the IP address associated with a domain name between the time of validation and the time of use—to conduct blind SSRF attacks against internal services.