The mcp-security framework in spring-ai-community, before version 0.1.9, fails to verify the safety of URLs used during OAuth discovery and metadata retrieval under Dynamic Client Registration. This lack of validation allows SSRF attacks, where an attacker can induce the server to send requests to unintended locations, potentially exposing internal network resources or sensitive data. The vulnerability is identified as CWE-918 and has a CVSS 3.1 score of 7.2, indicating a high severity level. The fix is included in version 0.1.9 of the mcp-security framework.

An attacker can exploit this SSRF vulnerability to cause the server to make unauthorized requests to internal or external systems, potentially leading to information disclosure or interaction with internal network services. The impact includes limited confidentiality and integrity loss but does not affect availability. This vulnerability only affects installations with Dynamic Client Registration enabled.

Upgrade the mcp-security framework to version 0.1.9 or later, where the SSRF mitigations are implemented as per the Model Context Protocol security specifications. Since the vendor advisory confirms the issue is fixed in 0.1.9, applying this update fully mitigates the vulnerability. No additional mitigations are specified.