CVE-2026-61546

AnkiMCP is an Anki addon that implements an MCP server, enabling AI assistants to interact with the Anki flashcard application. Prior to version 0.21.0, `anki_mcp_server/mcp_server.py` globally disables FastMCP DNS-rebinding protection through `TransportSecuritySettings` with `enable_dns_rebinding_protection=False`, including for the default local Streamable HTTP listener. The defaults in `anki_mcp_server/config.py` enable `http_enabled` on `127.0.0.1:3141`, with an empty `http_path` selecting the root endpoint. No bearer token, API key, session secret, strict `Host` allowlist or strict `Origin` allowlist is enforced before `initialize`, `tools/list` and `tools/call` reach MCP dispatch. A victim who visits a malicious web page while Anki and the listener are running can have browser requests rebound to loopback, allowing the attacker to `initialize` MCP, enumerate tools, read the local collection, and perform enabled non-destructive note/deck creation or updates. The attacker needs neither LAN position nor a local process. Available operations depend on enabled tool filters; destructive tools are hidden unless `enabled_destructive_tools` is opted into, limiting deletion-level impact but not the exposed read/write operations. The reported harness confirms real MCP tool dispatch with substituted Anki bridge responses rather than demonstrating destructive changes to a real collection. Disabling protection for tunnels/proxies also disables it for the normal loopback configuration. This issue is fixed in version 0.21.0.

• CWE-346
• CWE-350

• https://github.com/ankimcp/anki-mcp-server-addon/commit/6dcb6939b0ecc0801f45cf0d241dc946aad1654f
• https://github.com/ankimcp/anki-mcp-server-addon/commit/d5306ff42d68f1e3b82a96878eb059437e820316
• https://github.com/ankimcp/anki-mcp-server-addon/security/advisories/GHSA-j9xx-59ph-wmr6
• https://github.com/ankimcp/anki-mcp-server-addon/tree/v0.21.0
• https://github.com/ankimcp/anki-mcp-server-addon/security/advisories/GHSA-j9xx-59ph-wmr6

Published

Oct 28, 2026

Last Modified

Oct 29, 2026

Status

Deferred

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61536Banks generates meaningful LLM prompts using a simple templa…7.5
• CVE-2026-61539Xinference is an inference API for running open-source, spee…10
• CVE-2026-6154A security flaw has been discovered in Totolink A7100RU 7.4c…9.8
• CVE-2026-61541Zapros, a Python HTTP client, prior to version 0.14.0 is vul…6.9
• CVE-2026-61542Gearboy is a Game Boy, Game Boy Color, and Super Game Boy em…8.6
• CVE-2026-61544libp2p-rust is the official Rust language implementation of …8.2
• CVE-2026-61548Rsyslog is a rocket-fast system for log processing. From 7.5…8.1
• CVE-2026-61549Woodpecker is a CI/CD engine. From 1.0.0 until 3.16.0, pipel…9
• CVE-2026-6155A weakness has been identified in Totolink A7100RU 7.4cu.231…9.8
• CVE-2026-61550Icinga 2 is an open source monitoring system. From 2.8 until…9.8
• CVE-2026-61551Icinga 2 is an open source monitoring system. Prior to 2.14.…8.6
• CVE-2026-61552Icinga 2 is an open source monitoring system. From 2.4 until…7.2