The mcp-security framework in spring-ai-community versions before 0.1.9 fails to validate untrusted URLs used for OAuth-related discovery and metadata, allowing SSRF attacks. This occurs because the framework does not enforce the SSRF mitigations mandated by the Model Context Protocol security specifications. The vulnerability is limited to environments where Dynamic Client Registration (DCR) is enabled. An attacker could exploit this by causing the server to make unauthorized requests to internal or malicious endpoints. The issue is resolved in version 0.1.9 of mcp-security.

Successful exploitation of this SSRF vulnerability could allow an attacker to make unauthorized requests from the vulnerable server to internal or external systems. This may lead to information disclosure or unauthorized interaction with internal services. The CVSS score of 7.2 indicates a high severity impact with potential confidentiality and integrity loss but no direct availability impact. The vulnerability only affects deployments with Dynamic Client Registration enabled.

This vulnerability is fixed in mcp-security version 0.1.9. Users should upgrade to version 0.1.9 or later to remediate the issue. Since no official patch links or vendor advisory content are provided, users should verify the upgrade from the official spring-ai-community sources. No other mitigations are specified or required if the upgrade is applied.