oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port. Tags, Referrers, and Repositories pagination operations then issue a GET request to the attacker-selected URL from the victim's network, allowing blind server-side request forgery against internal services. The response body is not returned to the attacker, but timing and error differences can reveal service reachability, and credentials may be attached when the credential store has an entry for the target host. Exploitation requires a victim to perform a pagination-based listing operation against a malicious registry. The maintainer identifies this report as a duplicate of GHSA-3hr5-mjrr-hfjh and states that remediation is consolidated in that earlier advisory. The consolidated issue is fixed in version 2.6.2.
CVE-2026-76559 is a Server-Side Request Forgery (SSRF) vulnerability in the WP Import Export Lite WordPress plugin versions before 3.9.33. It occurs because the plugin does not properly validate URLs during the import process, allowing users with import capability (typically administrators) to make the site send requests to internal hosts and services and read their responses. This vulnerability is a partial fix of a previous issue (CVE-2026-11397).
`@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Starting in version 0.0.1 and prior to version 2.1.27, when the environment variable `ENABLE_DYNAMIC_API_URL=true` is set, the server reads the `X-GitLab-API-URL` HTTP request header and uses it as the base URL for all outbound GitLab API calls made within that request. The server validates that the value is a well-formed URL (`new URL(dynamicApiUrl)`) but applies no allowlist or hostname restriction. The server then attaches the victim's `Private-Token` to every outbound fetch that uses the redirected URL. Any caller who can reach the HTTP transport can set `X-GitLab-API-URL` to an attacker-controlled host. The next GitLab API call the server makes delivers the victim's token to that host. Version 2.1.27 contains a patch.
Fireshare versions prior to 1.6.16 contain a Server-Side Request Forgery (SSRF) vulnerability due to missing authentication on two API endpoints. An unauthenticated attacker can make the server send arbitrary HTTP POST requests to any URL, including internal network resources and cloud metadata services. This vulnerability is patched in version 1.6.16.
OpenCTI-Platform versions prior to 7.260701.0 contain a Server-Side Request Forgery (SSRF) vulnerability in the synchronizerFetch GraphQL query. This flaw allows authenticated users with the INGESTION capability to make requests to internal services and cloud metadata endpoints without proper restrictions. The vulnerability enables internal network scanning and potential disclosure of internal data. The issue is fixed in version 7.260701.0.
mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, web_url_read receives its caller-controlled URL through src/index.ts and validates only the literal hostname in assertUrlAllowed() within src/url-reader.ts before undiciFetch() performs operating-system DNS resolution. A public-looking attacker-controlled hostname that resolves to a private, loopback, link-local, or cloud-metadata address therefore passes the lexical check and causes the MCP server to connect to the internal destination. In the default HTTP configuration, an unauthenticated network client can use this path to read internal services, expose credentials or service tokens, and enumerate reachable internal hosts; in STDIO deployments, prompt-influenced tool selection can provide the malicious URL. Direct private IP literals are blocked, and MCP_HTTP_ALLOW_PRIVATE_URLS remains an explicit opt-out. This issue is fixed in version 1.7.1.
mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, web_url_read passes a caller-supplied URL to the server-side fetch path while assertUrlAllowed() in src/url-reader.ts runs only when MCP_HTTP_HARDEN is enabled, even though MCP_HTTP_HARDEN is disabled by default in src/http-security.ts. In the default configuration, an attacker who influences the URL selected by a user or AI agent can make the server fetch loopback, private-network, or cloud metadata endpoint resources and return their contents into the model context. file:// URLs remain rejected, and the separate DNS-resolution and redirect-validation bypasses are outside this record. This issue is fixed in version 1.2.0.
mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, the web_url_read URL policy in src/url-reader.ts can be bypassed while MCP_HTTP_HARDEN is enabled and MCP_HTTP_ALLOW_PRIVATE_URLS is not enabled because redirect targets are not revalidated, 0.0.0.0 is not classified as an internal address, and IPv4-mapped IPv6 literals canonicalized to hexadecimal form are not recognized. These inputs allow an attacker-influenced tool call to make the MCP server fetch loopback or internal HTTP resources and return content from local services, private APIs, service-mesh endpoints, or cloud metadata endpoints. The separate hostname-to-private-address case addressed by the earlier partial fix is not part of these residual bypasses. This issue is fixed in version 1.2.0.
canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl() joins values returned by Request::getPathVariables() without encoding individual path segments, including the scheme and contentId values used by GetContentDetailsRequest. When a consuming application supplies an untrusted path variable value, path traversal sequences, query delimiters, or fragment delimiters can change the destination endpoint before AbstractEndpoint::sendRequest() attaches the configured authentication token. An attacker who controls that path variable value through the consuming application can cause unintended reads or writes with the configured application's privileges on the same Canto instance, but applications that pass only trusted and validated identifiers are not exploitable. This issue is fixed in version 3.0.0.
CVE-2026-54549 is a server-side request forgery (SSRF) vulnerability in the meta-ads-mcp product by pipeboard-co. The flaw exists in versions prior to 1.0.115 in the upload_ad_image tool, which improperly handles attacker-controlled URLs without validating scheme, host, or resolved IP address. This allows an attacker to make the server perform unauthorized HTTP requests to internal or private network resources. The vulnerability is fixed in version 1.0.115.
Lokka is a Model Context Protocol server for Microsoft 365, including Microsoft Graph and other services. Prior to 2.1.2, the Lokka-Microsoft tool in src/mcp/src/main.ts uses direct URL string concatenation to append the user-controlled path value to the management.azure.com base URL. A specially crafted path can alter URL authority parsing and cause an Azure Resource Manager bearer token to be sent to an unintended host. This issue is fixed in version 2.1.2.
CVE-2026-58196 is a Server-Side Request Forgery (SSRF) vulnerability in stacklok's toolhive utility versions prior to 0.31.0. The flaw arises from the handling of authentication discovery URLs, where the server-side HTTP clients trust remote-server-controlled destinations and follow redirects without proper restrictions. This allows a malicious or compromised MCP server to induce the toolhive client to make unauthorized requests to internal-only HTTP services, including link-local and RFC1918 addresses. The vulnerability can be exploited to access internal metadata services such as AWS IMDSv1, potentially leaking sensitive credentials. The issue is fixed in version 0.31.0.
CVE-2026-54450 is a Server-Side Request Forgery (SSRF) vulnerability in the stacklok toolhive utility prior to version 0.29.1. The flaw arises because the networking.IsPrivateIP function incorrectly classifies certain IPv6 NAT64 prefixes as public, allowing attacker-controlled requests to reach internal IPv4 addresses via NAT64 translation. This enables an attacker to probe internal TCP or TLS services blindly. The vulnerability does not allow exfiltration of metadata credentials and does not affect the webhook client. The issue is fixed in version 0.29.1.
Server-Side Request Forgery (SSRF) vulnerability in Slab safeurl allows an attacker who controls a validated URL to reach internal network destinations the library is configured to block.
Only IPv4 addresses are matched against the reserved ranges and the blocklist. Every other address is treated as matching nothing, so a destination that is rejected in its IPv4 form is accepted when written as an IPv6 address, IPv6 entries in the blocklist never match, and a host that resolves to no IPv4 address is accepted regardless of where it points. Deployments that rely on the allowlist instead are unaffected, because there an unmatched address is rejected.
This issue affects safeurl: from 0.1.0 onward.
Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.28.0, makeRemoteRequest() in src/serverroutes.ts accepted attacker-controlled host, port, useTLS, and selfsignedcert parameters from the testSignalKConnection, requestAccess, and checkAccessRequest endpoints without validating the destination. When security was not configured, addAdminMiddleware() was a no-op in dummysecurity.ts, leaving all three endpoints accessible without authentication. The server could be forced to contact loopback, private, link-local, cloud metadata, or arbitrary external destinations, and selfsignedcert could disable certificate verification for outbound HTTPS requests. The checkAccessRequest endpoint also interpolated requestId into its destination path, allowing traversal to other paths on the selected host. Distinct success, connection-refused, and timeout responses enabled internal port scanning; returned response bodies enabled cloud metadata and internal-service data exfiltration; requestAccess enabled server-side POST requests with attacker-controlled JSON; and access to cluster-internal services could support lateral movement. This issue is fixed in version 2.28.0.
GeoNetwork core-geonetwork versions prior to 4.2.17 and 4.4.12 contain a server-side request forgery (SSRF) vulnerability in the POST /api/tools/ogc/sld endpoint. This endpoint accepted a user-supplied WMS server URL and performed an HTTP GET request without validating the destination. An anonymous attacker could exploit this to make the server send requests to internal, non-publicly reachable hosts. If the response was XML, the server could store and return the fetched content, enabling internal data disclosure, authorization bypass, and network reconnaissance. The vulnerability is fixed in versions 4.2.17 and 4.4.12.
ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java did not require administrative privileges and passed its source to integration/src/main/java/com/arcadedb/integration/importer/SourceDiscovery.java without validation. An authenticated user with SQL command access through /api/v1/command or /api/v1/query can supply HTTP or HTTPS destinations to make server-side requests to internal services, or file:// paths to read files accessible to the server process and ingest the results as queryable records. The XML importer also permits DTD processing and external entities, enabling entity expansion. The root-only /api/v1/server administration endpoint is not affected. The fix requires updateSecurity permission, blocks local-network import destinations by default through arcadedb.server.security.importBlockLocalNetworks, supports the arcadedb.server.security.importAllowedLocalPaths file allow-list, and disables XML DTD processing and external entities. This issue is fixed in version 26.6.1.
CVE-2026-59973 is a Server-Side Request Forgery (SSRF) vulnerability in the agentfront frontmcp framework affecting versions prior to 1.5.0 and 2.5.0. It allows an authenticated user with the ability to import or configure OpenAPI specifications to cause backend-origin requests to internal services by exploiting insufficient validation of external $ref URLs. This can expose internal administrative APIs and private network endpoints. The vulnerability is fixed in frontmcp and related packages version 1.5.0 and mcp-from-openapi 2.5.0.
Contentful MCP Server is a Model Context Protocol server for the Contentful Management API. Prior to @contentful/mcp-server 1.7.19 and @contentful/mcp-tools 0.4.5, export_space and import_space in packages/mcp-tools/src/tools/jobs/space-to-space-migration/exportSpace.ts and packages/mcp-tools/src/tools/jobs/space-to-space-migration/importSpace.ts expose host, proxy, rawProxy, and insecure network options to LLM-controlled tool arguments and combine those options with the server's CONTENTFUL_MANAGEMENT_TOKEN. After space_to_space_migration_handler enables the migration tools, a direct MCP call or prompt injection through attacker-controlled Contentful content can redirect Contentful Management API requests and their Authorization header to an attacker-controlled host or proxy. The regular tools that use createToolClient are unaffected because those tools pin the host from server configuration. Exposure of the personal access token permits persistent out-of-band access to every Contentful space within the token's scope. This issue is fixed in @contentful/mcp-server 1.7.19 and @contentful/mcp-tools 0.4.5.
Dragonfly versions prior to 2.4.4-rc.3 contain a Server-Side Request Forgery (SSRF) vulnerability in the scheduler's unauthenticated v1 gRPC flow. An attacker can supply malicious PeerHost.Ip and PeerHost.DownPort values, causing the system to make HTTP GET requests to internal or private network addresses. This allows the attacker to read up to 128 bytes of data from these internal services. The vulnerability is limited to read-only SSRF and does not allow remote code execution. The issue is fixed in version 2.4.4-rc.3.