What happened
Imperva Threat Research published on 2026-09-25 a technical analysis showing the Microsoft DevLabs DebugMCP server starts unauthenticated on port 3001 on install, and omitted the DNS-rebinding host/origin-header validation that the MCP SDK recommends; the research demonstrates both a compromised-neighbour-device path and a no-click DNS-rebinding path to arbitrary tool invocation and code execution.
Why it matters
Developer-facing MCP servers are an emerging mass-exploitation surface (DNS-rebinding MCP RCE was previously demonstrated against other popular servers). An unauthenticated, auto-starting devtools MCP server that trusts localhost browser traffic hands a malicious web page the full tool capability of the developer's machine (browser control, file/debug access).
Attack vector
Two paths: (1) from a surrounding compromised device that can reach the listening port, drive MCP tools without authentication; (2) DNS rebinding — victim simply browses to a malicious site that rebinds to loopback — to invoke MCP tools and reach attacker-controlled actions on the local machine, up to command execution.
Affected systems
Microsoft DevLabs DebugMCP MCP server (installed via VS Code extension / npm); served on port 3001 without authentication.
Mitigation
No CVE/fix published at disclosure time (2026-09-25). Mitigate by installing the server only in trusted environments, blocking inbound access to port 3001, and applying the official modelcontextprotocol validateHostHeader/validateOriginHeader middleware that the MCP reference SDK now provides.