CVE-2026-35577: Apollo MCP Server DNS Rebinding via Missing Host Header Validation in StreamableHTTP Transport

SentinelOne Vulnerability Database·medium signal

Apollo MCP Server versions before 1.7.0 do not validate Host headers on incoming HTTP requests when using StreamableHTTP transport. Attackers can use DNS rebinding to bypass same-origin policy and invoke tools or access resources on localhost-bound MCP instances. Upgrade to 1.7.0+ or switch to stdio transport mode as mitigation.