Threat database

TencentCloud Octop versions up to 1.0.2b6 have a missing authorization vulnerability that permits authenticated low-privileged users to access stored provider API keys. The flaw allows these users to retrieve plaintext LLM and voice provider API keys by querying specific API endpoints that only validate JWT tokens without proper authorization checks.

CVE-2026-7221 is a server-side request forgery (SSRF) vulnerability in TencentCloudBase CloudBase-MCP versions up to 2.17.0. The vulnerability exists in the openUrl function of the open-url API endpoint, where manipulation of the req.body.url argument allows an attacker to make unauthorized requests from the server. The vulnerability can be exploited remotely without authentication. A patch is available in version 2.17.1 to address this issue.