Is there a public PoC exploit available for CVE-2026-10661?

Yes, a public proof-of-concept exploit is available for CVE-2026-10661. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2026-10661?

Yes, a patch is available for CVE-2026-10661. Update the affected software to the latest version immediately.

blender-mcp CVE-2026-10661

Q: What is the CVSS score of CVE-2026-10661?

CVE-2026-10661 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34036 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-06-02 VulDB

GHSA-qqw9-95ww-prfm

Information Disclosure Blender Mcp Ahujasid

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 02, 2026 - 22:22 NVD

MEDIUM LOW

CVSS changed

Jun 02, 2026 - 22:22 NVD

4.3 (MEDIUM) 2.1 (LOW)

Source Code Evidence Fetched

Jun 02, 2026 - 22:01 vuln.today

Analysis Generated

Jun 02, 2026 - 22:01 vuln.today

DescriptionCVE.org

A vulnerability has been found in ahujasid blender-mcp up to 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b. Impacted is the function Open of the file src/blender_mcp/server.py. The manipulation of the argument input_image_url leads to injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The identifier of the patch is 5b37be25242e73dc4cf1328974d30458b9e5d67e. To fix this issue, it is recommended to deploy a patch.

AnalysisAI

Server-Side Request Forgery and arbitrary file read in ahujasid/blender-mcp allows authenticated remote attackers to exfiltrate local filesystem content or pivot to internal network services via unsanitized manipulation of the input_image_url parameter in the generate_hunyuan3d_model function (src/blender_mcp/server.py). The parameter is passed without validation directly to both open() for local file reads and requests.get() for remote fetches, enabling path traversal and SSRF primitives simultaneously. A publicly available exploit exists (GitHub issue #202); no CISA KEV listing at time of analysis. The fix has been merged upstream (PR #205, commit 5b37be25).

Technical ContextAI

blender-mcp is a Model Context Protocol (MCP) server that enables AI assistants to drive Blender 3D operations programmatically. The vulnerable function generate_hunyuan3d_model in src/blender_mcp/server.py accepts input_image_url as an unvalidated string used both as a local filesystem path (fed to open()) and as a remote URL (fed to requests.get()), without checking whether the path resolves outside an expected directory or whether the URL resolves to an internal/loopback address. This constitutes CWE-74 (Improper Neutralization of Special Elements - Injection) manifesting as two distinct attack primitives: arbitrary local file read via path traversal (e.g., supplying /etc/passwd or /root/.ssh/id_rsa) and SSRF by supplying URLs whose hostnames resolve to RFC 1918, loopback, or link-local addresses. The patch (commit 5b37be25) adds _validate_image_path() using os.path.realpath() to restrict paths to a whitelist of image extensions, and _validate_url_not_internal() using Python's ipaddress module to block DNS resolution to private/loopback/link-local ranges, plus IP-pinning to defeat DNS rebinding TOCTOU attacks. Affected CPE: cpe:2.3:a:ahujasid:blender-mcp:*:*:*:*:*:*:*:*.

RemediationAI

Apply the upstream fix by updating to any revision at or after commit 5b37be25242e73dc4cf1328974d30458b9e5d67e, which was merged via PR #205 (https://github.com/ahujasid/blender-mcp/pull/205). The patch introduces URL validation blocking resolution to private/loopback/link-local/reserved addresses and restricts local image paths to a whitelist of extensions (.png, .jpg, .jpeg, .gif, .bmp, .tiff, .tif, .webp, .svg, .ico, .heic, .heif) with a 10 MB size cap, using os.path.realpath() to prevent symlink traversal. Note that the upstream fix is available as a PR/commit - a tagged released version is not independently confirmed at time of analysis. As a compensating control prior to patching, restrict network-level access to the blender-mcp MCP endpoint to trusted authenticated principals only, and run the blender-mcp process under a least-privilege OS user with filesystem access scoped to the Blender working directory. If Hunyuan 3D model generation functionality is not required, disabling or removing those tool handlers eliminates this attack surface entirely with no functional side effects for standard Blender MCP workflows.