CVE-2026-14748 describes a server-side request forgery vulnerability in AIAnytime Awesome-MCP-Server, specifically in the mcp-wiki/wiki-summary component's server.py file. The issue arises from improper handling of the 'url' argument, allowing an attacker to cause the server to make unintended requests. The vulnerability can be exploited remotely without user interaction and has a CVSS 4.0 base score of 5.3 (medium severity). The product's rolling release model means no explicit affected or fixed versions are available. The vendor has been notified but has not yet provided a remediation or patch.

Successful exploitation allows an attacker to induce the server to make arbitrary HTTP requests, potentially accessing internal resources or services not otherwise reachable. This can lead to information disclosure or interaction with internal systems. The vulnerability does not require user interaction and can be triggered remotely. The CVSS score indicates a medium impact level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor official channels for updates. Until a patch is available, consider restricting server outbound requests or applying network-level controls to limit SSRF impact.