CVE-2026-62316

The UFO vulnerability exposes a dangerous pattern: developers added authentication to a localhost service assuming the browser could never reach it, then deployed it in configurations that made the API key trivially accessible to any web page the victim visits. The CVE is rated 8.8, but the real danger is worse than the score suggests because the credential actively makes things worse. Without the API key, a DNS rebinding attack could reach the endpoint but couldn't execute commands. With it, a single successful rebinding hop grants full code execution. This is the opposite of defense-in-depth — the authentication layer functions as an escalation enabler in the browser-context threat model. The deeper issue is that MCP was designed as an internal tooling bus for trusted AI agents, not for deployment contexts where arbitrary web origins are callers. FastMCP exported the protocol over HTTP carrying those same implicit trust assumptions. The protocol's tool enumeration endpoint (`/tools/list`) — useful for legitimate AI agents — becomes attack surface when reachable from browser contexts. Your deployment likely has this exposure if FastMCP is running with default settings and the machine has any browser activity. The 3.0.8 fix addresses the immediate DNS rebinding vector, but examine what it actually changes: header validation is fragile and bypassable with proxy tricks, while binding changes or CSP-origin restrictions address the architectural problem. The framework provides no guidance on which configurations are safe against web-origin attacks — that's the real gap. Treat localhost as a network boundary, not a security boundary. Audit whether your MCP deployments expose API keys to any path the browser can reach, and assume the next rebinding technique will bypass whatever header checks were added.

Reviewed through automated stages and approved by a human before publication.