This vulnerability in ShadowCloneLabs GlutamateMCPServers up to commit e2de73280b01e5d943593dd1aa2c01c5b9112f78 involves an SSRF flaw in the puppeteer_navigate component's handling of the url argument in src/puppeteer/index.ts. An attacker can remotely manipulate this argument to cause the server to send unauthorized requests. The vulnerability was publicly disclosed but the vendor has not yet issued a response or patch. The product's rolling release model complicates version tracking for affected or fixed releases. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with low confidentiality, integrity, and availability impacts.

Successful exploitation allows remote attackers to perform server-side request forgery, potentially causing the server to make unintended HTTP requests. This could lead to information disclosure or interaction with internal systems depending on the server's network environment. However, the CVSS score and vector indicate limited impact on confidentiality, integrity, and availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for updates from ShadowCloneLabs. Until a patch is released, consider restricting server outbound requests or implementing network-level controls to limit SSRF impact where feasible.