CVE-2026-25904VulnerabilityPublished 9 Feb 2026

CVE-2026-25904: mcp-run-python · Server-Side Request Forgery (SSRF)

Affects mcp-run-pythonSource CVE Database V5

Not known to be exploited · CVSS 5.8 Medium.

Data as of 26 Oct 2026, 06:26 UTC

CVSS 3.1 base score

5.8Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.1% chance of exploitation in 30 days – higher than 8% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector: Network
Attack Complexity: High
Privileges Required: None
User Interaction: Required
Scope: Changed
Confidentiality: Low
Integrity: Low
Availability: Low

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: High: A successful attack depends on conditions beyond the attacker's control. That is, a successful attack cannot be accomplished at will, but requires the attacker to invest in some measurable amount of effort in preparation or execution against the vulnerable component before a successful attack can be expected. For example, a successful attack may require an attacker to: gather knowledge about the environment in which the vulnerable target/component exists; prepare the target environment to improve exploit reliability; or inject themselves into the logical network path between the target and the resource requested by the victim in order to read and/or modify network communications (e.g., a man in the middle attack).
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: Required: Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited.
Scope: Changed: An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component. In this case, the vulnerable component and the impacted component are different and managed by different security authorities.
Confidentiality: Low: There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the impacted component.
Integrity: Low: Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact on the impacted component.
Availability: Low: Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. The resources in the impacted component are either partially available all of the time, or fully available only some of the time, but overall there is no direct, serious consequence to the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 9 Feb 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
PyPImcp-run-python`pkg:pypi/mcp-run-python`Other threats	Affected =0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

1. Discontinue use of the Pydantic-AI MCP Run Python tool immediately, especially in production or sensitive environments, since it is archived and will not receive patches. 2. If continued use is necessary, isolate the sandbox environment using strict network segmentation and firewall rules to prevent access to localhost or internal network interfaces. 3. Employ network-level controls such as egress filtering to block unauthorized outbound requests from sandboxed processes. 4. Review and harden sandbox configurations to enforce the principle of least privilege, explicitly denying network access unless absolutely required. 5. Use alternative, actively maintained sandboxing tools with robust security controls and regular updates. 6. Implement monitoring and alerting for unusual network requests originating from sandboxed environments to detect potential SSRF attempts. 7. Educate developers and users about the risks of executing untrusted code and require code review or validation before execution. 8. Conduct regular security assessments of sandbox configurations and network access controls to identify and remediate similar misconfigurations.

Description

CVE-2026-25904 is a Server-Side Request Forgery (SSRF) vulnerability in the Pydantic-AI MCP Run Python tool, which uses an overly permissive Deno sandbox configuration. This misconfiguration allows Python code executed within the sandbox to access the localhost interface of the host system, potentially enabling SSRF attacks. The project is archived and unlikely to receive a fix, increasing risk for users who continue to rely on it. The vulnerability has a CVSS score of 5.8 (medium severity), reflecting moderate impact and exploitation complexity. Exploitation requires user interaction but no privileges or authentication. While no known exploits are currently in the wild, the vulnerability could allow attackers to access internal services, leading to information disclosure and limited integrity and availability impacts. European organizations using this tool or similar configurations should be cautious, especially those in countries with strong adoption of Python and Deno-based development environments. Mitigation involves discontinuing use of the vulnerable tool, isolating sandbox environments, and restricting network access from sandboxed code. Countries with significant tech sectors and software development communities, such as Germany, France, the UK, and the Netherlands, are most likely to be affected.

Impact

For European organizations, the impact of CVE-2026-25904 depends largely on their use of the Pydantic-AI MCP Run Python tool or similar sandbox configurations. Organizations relying on this tool for Python code execution in isolated environments may be exposed to SSRF attacks that can access internal network services, potentially leading to unauthorized information disclosure or reconnaissance. This can facilitate lateral movement or further exploitation within the network. Although the impact on integrity and availability is rated low, the confidentiality breach could expose sensitive internal APIs or services. The archived status of the project means no official patches will be released, increasing the risk for organizations that continue to use it. European companies in sectors such as software development, cloud services, and research institutions that use Deno or Python sandboxing tools are particularly at risk. The requirement for user interaction limits automated exploitation but does not eliminate risk, especially in environments where users execute untrusted code. The medium severity rating suggests that while the threat is not critical, it warrants attention to prevent potential internal network compromises.

Summary

CVE-2026-25904 is a Server-Side Request Forgery (SSRF) vulnerability classified under CWE-918, found in the Pydantic-AI MCP Run Python tool. This tool configures the Deno sandbox environment with overly permissive network access, allowing Python code executed within the sandbox to make requests to the localhost interface of the host machine. SSRF vulnerabilities enable attackers to induce the server-side application to send crafted requests to internal or external systems that would otherwise be inaccessible, potentially exposing sensitive information or enabling further attacks. The vulnerability arises because the sandbox does not properly restrict network access, violating the principle of least privilege. The project is archived, meaning no patches or fixes are expected, leaving users exposed if they continue to use this tool. The CVSS v3.1 base score is 5.8, indicating a medium severity level. The vector indicates network attack vector (AV:N), high attack complexity (AC:H), no privileges required (PR:N), user interaction required (UI:R), scope changed (S:C), and low impact on confidentiality, integrity, and availability (C:L/I:L/A:L). Although no known exploits are reported in the wild, the vulnerability could be exploited by tricking a user into executing malicious Python code within the sandbox, which then performs SSRF attacks against internal services. This can lead to information disclosure or limited disruption of internal services. The vulnerability highlights the risks of misconfigured sandbox environments, especially when running untrusted or semi-trusted code.

CWE-918Server-Side Request Forgery (SSRF) (opens in a new tab)
Base weaknessCWE Top 25 (2025): #22OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
OWASP Cheat Sheets
Server Side Request Forgery Prevention (opens in a new tab)
Unvalidated Redirects and Forwards (opens in a new tab)
Cross Site Scripting Prevention (opens in a new tab)
DOM based XSS Prevention (opens in a new tab)
Authorization (opens in a new tab)
OWASP ASVS 4.0.3
V12.6.1 (opens in a new tab)
V5.2.6 (opens in a new tab)
Attack patterns
Server Side Request Forgery (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

research.jfrog.com/vulnerabilities/mcp-run-python-deno-ssrf-jfsa-2026-001653029/ (opens in a new tab)

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 16 Feb 2026, 13:34 UTC

WeaknessesCWE-918

Technical details

References

Community reviews

Related threats