Security: DNS rebinding protection is opt-in, not enabled by default #3784

Security Configuration Recommendation

The TransportSecurityMiddleware in mcp/server/transport_security.py has DNS rebinding protection available but disabled by default:

self.settings = settings or TransportSecuritySettings(enable_dns_rebinding_protection=False)

Every deployment that does not explicitly pass TransportSecuritySettings(enable_dns_rebinding_protection=True, allowed_hosts=[...]) is vulnerable to DNS rebinding attacks.

Impact

DNS rebinding bypasses same-origin policy and allows malicious webpages to interact with local MCP servers. Most MCP servers run on localhost during development.

Recommendation

1. Enable DNS rebinding protection by default
2. Or at minimum: log a warning when disabled
3. Document the risk prominently
4. Consider a strict mode that enables all protections

Reference

Same class as GHSA-9h52-p55h-vw2f. Similar to TypeScript SDK maxToolInputElements being off by default (GHSA-46jr).

Verified in mcp 1.29.0 and 2.2.0 source.