Really?? Dropbox really needs a MCP server? https[:]//github[.]com/dropbox/mcp-server-dash CVE-2026-81102 The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcp_server_dash.py constructed the server for its network mode with the interface restricted to loopback and no transport-security settings, so a name that had been pointed at the loopback address still reached the listener while carrying the attacker's host name. A page in a visitor's browser could therefore drive the local server and invoke its company-search and file-detail tools under the Dropbox credential the server holds. Only the network mode was reachable this way; the standard input mode was not. The fix supplies transport-security settings that enable host checking and allow only the loopback name and port, rejecting other hosts before a tool runs. The repository publishes no versions, so the affected boundary is the commit preceding the fix.
Post summary
The post discloses CVE‑2026‑81102, explaining how the Dropbox MCP server’s lack of host verification on the loopback interface allows local requests to trigger privileged tool execution, and notes that a repository patch adds transport‑security host checks to mitigate the flaw.