CVE-2026-10662: Server-Side Request Forgery in ahujasid blender-mcp
A vulnerability was found in ahujasid blender-mcp up to 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b. The affected element is the function requests.get of the file src/blender_mcp/server.py of the component ZIP File Handler. The manipulation of the argument zip_file_url results in server-side request forgery. The attack can be executed remotely. The exploit has been made public and could be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The patch is identified as 5b37be25242e73dc4cf1328974d30458b9e5d67e. It is advisable to implement a patch to correct this issue.
AI Analysis
Technical Summary
This vulnerability in ahujasid blender-mcp up to commit 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b involves improper validation of the zip_file_url parameter in the ZIP File Handler component. The function requests.get in src/blender_mcp/server.py is susceptible to server-side request forgery, enabling remote attackers to cause the server to initiate arbitrary HTTP requests. The project uses a rolling release model, so specific version numbers for affected or fixed releases are not available. A patch has been identified by commit 5b37be25242e73dc4cf1328974d30458b9e5d67e, but no official vendor advisory or patch distribution details are provided.
Potential Impact
Successful exploitation allows an attacker to make the vulnerable server perform arbitrary HTTP requests, potentially accessing internal resources or services not directly reachable by the attacker. This can lead to information disclosure or further network-based attacks. The CVSS score of 5.3 reflects a medium impact level with network attack vector and low complexity.
Mitigation Recommendations
A patch commit (5b37be25242e73dc4cf1328974d30458b9e5d67e) has been identified to address this SSRF vulnerability. It is advisable to apply this patch to the affected codebase to remediate the issue. Since the project uses a rolling release model, users should update to the latest commit that includes this fix. Patch status is not officially confirmed by a vendor advisory; therefore, users should verify the patch integration in their deployments.
CVE-2026-10662: Server-Side Request Forgery in ahujasid blender-mcp
Description
A vulnerability was found in ahujasid blender-mcp up to 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b. The affected element is the function requests.get of the file src/blender_mcp/server.py of the component ZIP File Handler. The manipulation of the argument zip_file_url results in server-side request forgery. The attack can be executed remotely. The exploit has been made public and could be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The patch is identified as 5b37be25242e73dc4cf1328974d30458b9e5d67e. It is advisable to implement a patch to correct this issue.
CVSS v4.0
Score 5.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in ahujasid blender-mcp up to commit 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b involves improper validation of the zip_file_url parameter in the ZIP File Handler component. The function requests.get in src/blender_mcp/server.py is susceptible to server-side request forgery, enabling remote attackers to cause the server to initiate arbitrary HTTP requests. The project uses a rolling release model, so specific version numbers for affected or fixed releases are not available. A patch has been identified by commit 5b37be25242e73dc4cf1328974d30458b9e5d67e, but no official vendor advisory or patch distribution details are provided.
Potential Impact
Successful exploitation allows an attacker to make the vulnerable server perform arbitrary HTTP requests, potentially accessing internal resources or services not directly reachable by the attacker. This can lead to information disclosure or further network-based attacks. The CVSS score of 5.3 reflects a medium impact level with network attack vector and low complexity.
Mitigation Recommendations
A patch commit (5b37be25242e73dc4cf1328974d30458b9e5d67e) has been identified to address this SSRF vulnerability. It is advisable to apply this patch to the affected codebase to remediate the issue. Since the project uses a rolling release model, users should update to the latest commit that includes this fix. Patch status is not officially confirmed by a vendor advisory; therefore, users should verify the patch integration in their deployments.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-06-02T15:24:57.055Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
- Gcve Source
- db.gcve.eu
Threat ID: 6a1f872ae29bf47b5044bf21
Added to database: 06/03/2026, 01:45:14 UTC
Last enriched: 06/03/2026, 01:48:34 UTC
Last updated: 07/14/2026, 19:47:30 UTC
Views: 71
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.