Repository navigation
Reject non-loopback Host headers for loopback ADK web servers #5288
Description
Summary
When the ADK web server is bound to loopback, such as the default 127.0.0.1, it should not accept requests with non-loopback Host header values.
The current origin check derives the request origin from the incoming Host header and then compares it with the Origin header. A DNS-rebound request can therefore use a non-loopback hostname in both headers, for example Host: rebind.attacker.example:8000 and Origin: http://rebind.attacker.example:8000, causing the request to be treated as same-origin even though the hostname is not a loopback host.
Impact
If an external page can reach a victim's running local ADK server through DNS rebinding, it may be able to send requests to local ADK APIs as if it were the local server origin. Depending on enabled routes and local agent configuration, this can allow the page to create or modify local eval inputs, trigger local agent runs, or read local API responses.
Expected behavior
When ADK is bound to a loopback host, the server should only accept loopback Host header values such as localhost, 127.0.0.1, and ::1. Non-loopback hostnames should be rejected before the origin comparison.
Validation
I have a PR prepared that:
- rejects non-loopback
Hostheaders when the server is bound to loopback - keeps the existing origin checks for allowed/cross-origin behavior
- adds a regression test for the DNS-rebound
Host/Originshape - reproduces the unsafe behavior on clean
origin/main: the rebound request returns200 true - verifies the patch returns
403 Forbidden: host not allowed - passes
tests/unittests/cli/test_fast_api.pyin Linux Docker:63 passed
Activity
klateefa commentedon Apr 16, 2026
@petrmarinec Thanks for reporting!
The server trusts the Host header, which attackers can
fakeusing DNS rebinding.Check theHost headerfirst. If the server is running onloopback, only allow localhost, 127.0.0.1, or ::1. Reject anything else with a 403 error.This blocks fake domains from bypassing security checks.Can you try this and let me know if the issue persists?petrmarinec commentedon Apr 16, 2026
Hi @klateefa,
PR #5289 implements this mitigation by checking the
Hostheader before the origin comparison when the server is bound to loopback. In that mode it only allows loopback host values such aslocalhost,127.0.0.1, and::1; a DNS-rebound shape like:Host: rebind.attacker.example:8000Origin: http://rebind.attacker.example:8000is rejected with
403 Forbidden: host not allowed.llalitkumarrr commentedon Jun 22, 2026
Hello @petrmarinec ,
Thank you for your contribution. Your PR is currently under review and we will reach out if any additional details are required. In the meantime, we appreciate your patience.
sasha-gitg commentedon Aug 11, 2026
Fixed here: #6227