CVE-2025-9611highSSRF & network2026-01-07
CVE-2025-9611: Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server Tools
Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections.
What it is
Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. This allows an attacker to perform a DNS rebinding attack via a victim’s web browser and send unauthorized requests to a locally running MCP server, resulting in unintended invocation of MCP tool endpoints.
How to check
- Affected: @playwright/mcp (npm) < 0.0.40.
- Compare your installed version with the range above (command below).
How to fix
- Upgrade @playwright/mcp to 0.0.40 or later.
npm ls @playwright/mcpSources
More advisories for this tool
- criticalCVE-2026-96620: Claude Agent SDK (Python) resume option lets attackers run commands
- criticalCVE-2026-95182: DeepSeek Harness can be tricked into running a planted fake npx
- criticalLangflow: adding an MCP server runs any command on the host (CVE-2026-105697, CVE-2026-105740)
- criticalCVE-2026-32871: FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability