CVE-2025-9611: Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server Tools
Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. This allows an attacker to perform a DNS rebinding attack via a victim’s web browser and send unauthorized requests to a locally running MCP server, resulting in unintended invocation of MCP tool endpoints.
References
- github.com/JLLeitschuh/security-research/security/advisories/GHSA-8rgw-6xp9-2fg3
- github.com/advisories/GHSA-6fg3-hvw7-2fwq
- github.com/microsoft/playwright-mcp
- github.com/microsoft/playwright-mcp/issues/1206
- github.com/microsoft/playwright/commit/1313fbd
- msrc.microsoft.com/report/vulnerability/VULN-164412
- nvd.nist.gov/vuln/detail/CVE-2025-9611
- www.vulncheck.com/advisories/microsoft-playwright-mcp-server-dns-rebinding-via-missing-origin-header-validation
Code Behaviors & Features
Detect and mitigate CVE-2025-9611 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →