CORS origin bypass in native-server HTTP API allows any website to drive the MCP server (CSWSH)

Summary

setupPlugins() in app/native-server/src/server/index.ts registers @fastify/cors with credentials: true, and validates the request Origin against SERVER_CONFIG.CORS_ORIGIN using origin.startsWith(pattern) for string entries. The 'http://127.0.0.1' entry is a substring match, not an origin match, so it can be satisfied by an origin an attacker fully controls.

Affected versions: confirmed on main at commit 139f838 (2026-09-04, latest at time of report).

Details

SERVER_CONFIG.CORS_ORIGIN is [/^chrome-extension:\/\//, /^moz-extension:\/\//, 'http://127.0.0.1']. The two RegExp entries are checked with .test(origin), correctly anchored. The string entry is checked with origin.startsWith(pattern):

const allowed = SERVER_CONFIG.CORS_ORIGIN.some((pattern) =>
  pattern instanceof RegExp ? pattern.test(origin) : origin.startsWith(pattern),
);

Any hostname an attacker registers under a domain they own - e.g. 127.0.0.1.evil.com, a syntactically valid DNS name under evil.com - produces an origin string (http://127.0.0.1.evil.com) that satisfies startsWith('http://127.0.0.1'), even though it identifies a completely different host the attacker controls, not the loopback interface.

/mcp (StreamableHTTPServerTransport) and /sse are the MCP protocol endpoints themselves - reachable, per this check, from any origin matching that bypass.

POC

(available upon request)

Impact

With credentials: true also set on the CORS plugin, a page hosted at an attacker-controlled domain that merely starts with http://127.0.0.1 can make credentialed cross-origin requests to this server from any browser tab, including speaking the MCP protocol directly to /mcp//sse - driving whatever browser-automation tools this server exposes (navigation, script execution, cookie/session access, screenshots, etc.) as if it were the legitimate extension, with no user interaction beyond visiting the page and no dependency on the extension's own origin restrictions.

I have a fix ready and have opened PR #383.