EUVD-2026-33738
GHSA-6w53-8mcc-fqqh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in horizon921 mcpilot 0.1.0. The impacted element is an unknown function of the file client/src/app/api/mcp/call/route.ts of the component MCP API Call Endpoint. The manipulation of the argument serverBaseUrl results in server-side request forgery. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Server-side request forgery in horizon921 mcpilot 0.1.0 allows unauthenticated remote attackers to force the server to issue arbitrary HTTP requests by supplying a malicious value to the serverBaseUrl parameter in the MCP API Call Endpoint (client/src/app/api/mcp/call/route.ts). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the attack requires no authentication and no user interaction, making it trivially reachable from the network. A public exploit exists (E:P), no vendor patch has been released, and the project maintainer has not yet responded to the responsible disclosure.
Technical ContextAI
mcpilot is a Model Context Protocol (MCP) client application, likely built on Next.js given the client/src/app/api/ route structure. The vulnerable component is a server-side API route (route.ts) that accepts a caller-controlled serverBaseUrl argument and uses it to construct or proxy outbound HTTP requests without sanitizing or allowlisting the target URL. CWE-918 (Server-Side Request Forgery) covers this root cause: the server acts as an HTTP proxy on behalf of the attacker, potentially reaching internal services (e.g., cloud metadata endpoints at 169.254.169.254, internal microservices, or localhost-bound admin interfaces) that are otherwise unreachable from the public internet. The CPE cpe:2.3:a:horizon921:mcpilot:*:*:*:*:*:*:*:* covers all versions, with 0.1.0 confirmed as the disclosed affected release.
RemediationAI
No vendor-released patch has been identified at time of analysis; the vendor has not responded to the disclosure filed via GitHub issue (https://github.com/horizon921/mcpilot/issues/1). As an immediate compensating control, restrict network access to the MCP API Call Endpoint (/api/mcp/call) using a reverse proxy, firewall rule, or middleware allowlist - this prevents unauthenticated external actors from reaching the vulnerable parameter. If the endpoint must remain externally accessible, implement server-side URL validation that restricts serverBaseUrl to an explicit allowlist of permitted MCP server hostnames and schemes, rejecting private IP ranges (RFC 1918), loopback addresses, and cloud metadata IP ranges (e.g., 169.254.169.254). Deployers running mcpilot in cloud environments should enforce IMDSv2 (AWS) or equivalent metadata service hardening to limit the blast radius of any SSRF exploitation. Note: blocking at the network layer does not fix the underlying code flaw and should be treated as temporary mitigation only until an upstream patch is applied.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today