gemini-cli Blocks SSRF Through MCP OAuth Discovery, Including DNS Rebinding

GitHub·high signalXBlueskyLinkedInCopy link

PR #29081, merged 2026-08-26 and shipped in nightly v0.59.0-nightly.20260827, enforces RFC 9728 §7.7 and RFC 8414 constraints across MCP OAuth metadata discovery, dynamic client registration, and token exchange/refresh. It requires HTTPS for remote endpoints (HTTP only for loopback to local servers), validates origin matching on resource_metadata in WWW-Authenticate challenges, blocks private IPv4/IPv6, link-local and IMDS [redacted], benchmark 198.18.0.0/15 and multicast ranges, and does asynchronous DNS resolution specifically to defeat rebinding. A remote MCP server could previously steer the CLI's own OAuth flow at cloud metadata endpoints.