NVD posts nine MCP server CVEs in one day

NVD published nine advisories for Model Context Protocol servers on August 25, and most reduce to the same mistake, trusting a browser's origin header as identity proof. That gap turns a private-sounding local setup into an open door, letting code running in any browser tab reach tools on that machine without asking permission.

PraisonAI validated incoming MCP requests with request_origin.startswith(allowed) checked against a localhost allowlist. A domain like localhost.attacker.com starts with "localhost" and passes, a flaw PraisonAI's GitHub advisory rates 7.6.

The requests also carry Content-Type: text/plain, so browsers skip the CORS preflight that would otherwise block them. Any tab open in a browser on that machine can call tools/call on the local server, no API key required.

genieacs-mcp has a related problem. When the MCP_AUTH_TOKEN environment variable is unset, its /mcp endpoint on loopback accepts requests with no authentication and checks neither the Host nor Origin header. The bug appears in genieacs-mcp's NVD listing, rated 8.8 and flagged as reachable through DNS rebinding.

Nextcloud MCP Server's webhook endpoint fails the same way for a different reason. WEBHOOK_SECRET defaults to None, so the endpoint accepts calls with no secret at all, rated 9.1.