BSidesSF 2026 - MCPwned: Hacking MCP Servers with One Skeleton Key... (Jonathan Leitschuh)

This talk, titled MCPwned, explores a significant yet often ignored weakness in MCP specifications, specifically focusing on browser-based DNS rebinding. Jonathan Leitschuh demonstrates how this vulnerability can be exploited to compromise SSE and streaming-HTTP MCP servers, allowing attackers to exfiltrate sensitive data and escalate their access. The session reveals how simply visiting a malicious website can lead to the hacking of a locally running MCP server, highlighting the implications of this skeleton key vulnerability.