The vulnerability CVE-2026-19770 affects feedmob fm-mcp-servers version 0.0.3 in the downloadReport function located in src/smadex-reporting/src/index.ts. An attacker with local access can manipulate the downloadUrl parameter to perform server-side request forgery, potentially causing the server to make unintended HTTP requests. The vulnerability is confirmed and publicly disclosed with a CVSS 4.8 (medium) score. No official patch or remediation has been provided by the vendor as of the publication date.

An attacker with local access can exploit this SSRF vulnerability to make the server send crafted HTTP requests to internal or external systems. This could lead to information disclosure or interaction with internal services not otherwise accessible. However, the attack requires local environment access, limiting remote exploitation risk. No known active exploitation in the wild has been reported.

No official patch or remediation is currently available from the vendor. Since exploitation requires local access, restricting local user permissions and network access can reduce risk. Monitor for updates from the vendor and apply any future patches promptly. Avoid exposing the vulnerable version (0.0.3) in production environments until fixed.