DNS Rebinding Tricks Your Agent Into Attacking Your Own Network
tldr;
DNS rebinding tricks your AI agent into connecting to internal network services by resolving a public hostname to a private IP address like 127.0.0.1 or 10.x.x.x.
DNS rebinding is an attack where a malicious MCP server URL resolves to a private or internal IP address, causing your AI agent to inadvertently access services on your local network or cloud infrastructure metadata endpoints.
How DNS rebinding works
- 1.An attacker registers a domain like
evil-mcp.example.com - 2.The DNS record initially points to a public IP (passing validation)
- 3.After the first request, the DNS record changes to
127.0.0.1or169.254.169.254 - 4.Your AI agent now makes requests to your internal network or cloud metadata API
Why this is dangerous for MCP
MCP agents make HTTP requests on behalf of the user. If an agent connects to what it thinks is an external MCP server but is actually hitting:
- >localhost, it could access local dev servers, databases, or admin panels
- >Cloud metadata (169.254.169.254), it could steal IAM credentials and service account tokens
- >Internal services (10.x.x.x), it could reach databases, APIs, or admin interfaces behind your firewall
How to fix it
- 1.Resolve DNS and verify the IP is public before connecting
- 2.Block connections to RFC 1918 private ranges and link-local addresses
- 3.Use DNS pinning to prevent mid-session rebinding
Our scanner performs this check automatically before any connection is made.