CVE-2025-9611: Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server Tools
Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. This allows an attacker to perform a DNS rebinding attack via a victim’s web browser and send unauthorized requests to a locally running MCP server, resulting in unintended invocation of MCP tool endpoints.
Published Jan 7, 2026
Affected packages
@playwright/mcp
- Ecosystem
- npm
- Affected
- < 0.0.40
- Fixed in
- 0.0.40
- Check
npm ls @playwright/mcp
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. This allows an attacker to perform a DNS rebinding attack via a victim’s web browser and send unauthorized requests to a locally running MCP server, resulting in unintended invocation of MCP tool endpoints.
References
- https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-8rgw-6xp9-2fg3
- https://nvd.nist.gov/vuln/detail/CVE-2025-9611
- https://github.com/microsoft/playwright/commit/1313fbd
- https://www.vulncheck.com/advisories/microsoft-playwright-mcp-server-dns-rebinding-via-missing-origin-header-validation
- https://github.com/microsoft/playwright-mcp/issues/1206
- https://msrc.microsoft.com/report/vulnerability/VULN-164412
- https://github.com/advisories/GHSA-6fg3-hvw7-2fwq
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology