CVE-2026-61546highBroken access control2026-10-28

CVE-2026-61546: AnkiMCP turns off DNS-rebinding protection, so a web page can call its MCP tools, upgrade to 0.21.0

The AnkiMCP add-on, which exposes Anki to AI assistants over MCP, disables FastMCP's DNS-rebinding protection before 0.21.0 and needs no token on its default 127.0.0.1:3141 listener. If you visit a malicious page while Anki is open, the page can rebind to loopback, list the MCP tools, read your collection and create or update notes and decks.

01.

What it is

anki_mcp_server/mcp_server.py sets enable_dns_rebinding_protection=False globally, including for the default local Streamable HTTP listener (CWE-346).

The default config enables HTTP on 127.0.0.1:3141 at the root path, and no bearer token, API key, Host allowlist or Origin allowlist is checked before initialize, tools/list and tools/call.

A malicious web page can use DNS rebinding to reach the listener through the victim's browser, read the local collection and run enabled non-destructive create or update tools.

Destructive tools stay hidden unless enabled_destructive_tools is turned on.

02.

How to check

Check the AnkiMCP add-on version in Anki (before 0.21.0 is affected).
Check whether http_enabled is on in the add-on config.

03.

How to fix

Update the AnkiMCP add-on to 0.21.0 or later.
Until then, turn off the HTTP listener or close Anki when you aren't using it with an assistant.
Leave enabled_destructive_tools off.

04.

Sources

More advisories for this tool