CVE-2026-81102

Name of the Vulnerable Software and Affected Versions Dash MCP server (affected versions not specified)

Description In network mode, the server binds its listener to the loopback address but fails to verify the host name of incoming requests. Within src/mcp server dash.py, the server is configured without transport-security settings, allowing requests directed at the loopback address to reach the listener even if they carry an attacker-controlled host name. This allows a malicious webpage in a visitor's browser to interact with the local server and execute the company-search and file-detail tools using the server's Dropbox credentials. This issue only affects the network mode and does not impact the standard input mode.

Recommendations Update the server to the latest commit that implements transport-security settings to enable host checking and restrict access to the loopback name and port. As a temporary mitigation, avoid using the network mode and use the standard input mode instead.