Version identification: Binaries of release v0.2.0 report version 0.1.0 (for example in --version output and in the MCP server information). Treat a build that reports 0.1.0 as affected; builds reporting 0.1.0 that predate release v0.2.0 were not assessed and must not be assumed unaffected.
The HTTP server did not validate the Host header of incoming requests. A web page whose domain name was re-pointed to the loopback address (DNS rebinding) could therefore be treated by the browser as same-origin with a CodeIndexer server running on the visitor’s machine.
On an installation without a dashboard password, such a page could read data served by the dashboard and its API — memory cards, project paths, per-project configuration and code-search results — and call the state-changing dashboard API endpoints, none of which required credentials on such an installation. On installations with a dashboard password set, endpoints that require a session were not exposed: the session cookie is scoped to the host name the user signed in on, so the rebound page does not carry it. The dashboard password option exists since v0.6.0; earlier releases had no password option.
127.0.0.1) is sufficient.HTTP server of codeindexer serve — the router that serves the web dashboard, the dashboard API and the MCP HTTP endpoints.
Source modules:
src/mcp/mod.rs, src/mcp/host_guard.rs, src/config.rs
Upgrade to CodeIndexer v0.12.0 or later. No alternative workaround is documented.
First fixed version: v0.12.0. Recommended upgrade: v0.12.0 or later, which includes the fixes for every advisory currently published in this collection.
v0.12.0 adds a Host allowlist as the outermost layer of the HTTP router. Loopback names and IP-address literals are always accepted, names listed in the allowed_hosts setting are accepted, and requests naming any other host are refused with HTTP 421 (Misdirected Request). If you reach the server through a custom host name, add that name to allowed_hosts after upgrading.
First affected version: v0.2.0 (release-tag commit).
Fix committed (d7e731482a63).
First fixed version: v0.12.0 (release-tag commit).
Advisory published.
Dates come from the project’s git history: fixes by their commit date, versions by the date of the commit their release tag points to — not necessarily the day a build became available for download.
d7e731482a63
2026-09-13
Host allowlist as the outermost router layer; foreign host names answered with 421.
CodeIndexer is proprietary software. Commit references identify internal development history and correlate this advisory with our security-review evidence. Their publication does not make the proprietary source code public.
Questions about this advisory, or a new vulnerability to report: email [email protected] or open a private advisory on GitHub. See our security policy for the full disclosure process.
We use a couple of small first-party cookies to keep the site working and remember your theme preference. No tracking, no ads. Learn more.