This vulnerability in atototo api-lab-mcp (<= 0.2.1) allows remote attackers to perform server-side request forgery by manipulating the source/url argument in the analyze_api_spec/generate_test_scenarios/test_http_endpoint function within the HTTP Interface component. The flaw enables the server to make unintended HTTP requests, potentially leading to information disclosure or interaction with internal systems. The issue was responsibly disclosed but remains unpatched as of the latest information. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with low to low integrity, availability, and confidentiality impacts. No vendor advisory or patch links are available, and the product is not a cloud service.

Successful exploitation allows an attacker to induce the vulnerable server to make arbitrary HTTP requests, which may lead to unauthorized access to internal resources or information disclosure. The impact is rated medium severity with a CVSS score of 6.9. There is no evidence of active exploitation in the wild at this time.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded or provided a fix, users should consider implementing network-level controls to restrict outbound HTTP requests from the affected service as a temporary mitigation. Monitor for updates from the vendor for an official fix. Avoid exposing the vulnerable API endpoint to untrusted networks until a patch is released.