CVE-2026-15750 describes a server-side request forgery vulnerability in the mastergo-magic-mcp product by mastergo-design, affecting versions 0.1 and 0.2.0. The vulnerability arises from improper handling of the url argument in the z.string function of src/tools/get-component-link.ts, within the mcp__getComponentLink component. An attacker can remotely manipulate this argument to cause the server to make unintended requests. Although the issue was reported early, the vendor has not responded or provided a fix. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low to low impact on confidentiality, integrity, and availability. No known exploits are reported in the wild.

Successful exploitation of this vulnerability allows an attacker to induce the server to make arbitrary requests to internal or external resources, potentially bypassing network restrictions or accessing sensitive information. The impact is rated medium with a CVSS score of 5.3, reflecting limited confidentiality, integrity, and availability impact. No known active exploitation has been reported.

No official fix or patch is currently available from the vendor. The project has not responded to the vulnerability report. Users should monitor the vendor's communications for updates and consider implementing network-level controls to restrict outbound requests from the affected component as a temporary mitigation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.