CVE-2026-61546

The AnkiMCP Anki addon (prior to version 0.21.0 ) is vulnerable to a DNS rebinding attack due to the global disabling of FastMCP DNS-rebinding protection in anki_mcp_server/mcp_server.py. Because the default configuration enables an HTTP listener on 127.0.0.1:3141 without enforcing bearer tokens,...