Model Context Protocol mcp-rdf-explorer version 1.0.0 contains a server-side request forgery vulnerability in the explore_url function of src/mcp-rdf-explorer/server.py. An attacker can remotely manipulate the url parameter to cause the server to make unintended requests. The vulnerability is publicly disclosed with available exploit code. The vendor was contacted but did not respond, and no official remediation or patch has been announced.

Successful exploitation allows an unauthenticated remote attacker to induce the server to make arbitrary requests, potentially accessing internal resources or services not directly reachable by the attacker. This can lead to information disclosure or further network-based attacks depending on the server's environment and network configuration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing network-level restrictions to limit outbound requests from the affected component and monitor for suspicious activity related to the explore_url function.