This vulnerability in ShadowCloneLabs GlutamateMCPServers up to commit e2de73280b01e5d943593dd1aa2c01c5b9112f78 involves server-side request forgery via the puppeteer_navigate component. By manipulating the url argument in src/puppeteer/index.ts, an attacker can cause the server to perform unauthorized requests. The vulnerability can be exploited remotely without authentication. The project was notified early but has not issued a fix or advisory. Due to the rolling release model, precise versioning details for affected or patched releases are not available.

Successful exploitation allows remote attackers to induce the server to make arbitrary requests, potentially accessing internal resources or services not otherwise accessible. This can lead to information disclosure or further network-based attacks. The vulnerability is rated medium severity with a CVSS 4.0 score of 6.9, reflecting the network attack vector and lack of required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. Until a patch is available, consider implementing network-level restrictions to limit outbound requests from the affected component if feasible.