The vulnerability CVE-2026-19753 affects Model Context Protocol mcp-rdf-explorer version 1.0.0. It is located in the explore_url function within src/mcp-rdf-explorer/server.py of the MCP Server component. By manipulating the url argument, an attacker can perform server-side request forgery (SSRF), potentially causing the server to make unintended requests. The vulnerability can be exploited remotely without authentication or user interaction. The vendor was contacted but has not provided any response or patch. The exploit is publicly available, indicating potential risk if not mitigated.

Successful exploitation of this SSRF vulnerability could allow an attacker to make arbitrary requests from the vulnerable server, potentially accessing internal resources or services not otherwise accessible. The CVSS 4.0 vector indicates network attack vector with low complexity and no privileges or user interaction required. The impact is rated medium, reflecting limited but significant risk due to SSRF.

No official fix or patch is currently available from the vendor, and the vendor has not responded to the disclosure. Users of mcp-rdf-explorer version 1.0.0 should consider implementing network-level restrictions to limit outbound requests from the MCP Server or apply other SSRF mitigations such as input validation or request filtering until a vendor patch is released. Monitor vendor channels for updates regarding an official fix. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.