Is there a public PoC exploit available for CVE-2026-10662?

Yes, a public proof-of-concept exploit is available for CVE-2026-10662. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2026-10662?

Yes, a patch is available for CVE-2026-10662. Update the affected software to the latest version immediately.

blender-mcp CVE-2026-10662

Q: What is the CVSS score of CVE-2026-10662?

CVE-2026-10662 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34037 LOW

Server-Side Request Forgery (SSRF) (CWE-918)

2026-06-02 VulDB

GHSA-5hr7-6m56-f3rg

SSRF Blender Mcp Ahujasid

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 02, 2026 - 23:22 NVD

MEDIUM LOW

CVSS changed

Jun 02, 2026 - 23:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Source Code Evidence Fetched

Jun 02, 2026 - 23:21 vuln.today

Analysis Generated

Jun 02, 2026 - 23:21 vuln.today

DescriptionCVE.org

A vulnerability was found in ahujasid blender-mcp up to 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b. The affected element is the function requests.get of the file src/blender_mcp/server.py of the component ZIP File Handler. The manipulation of the argument zip_file_url results in server-side request forgery. The attack can be executed remotely. The exploit has been made public and could be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The patch is identified as 5b37be25242e73dc4cf1328974d30458b9e5d67e. It is advisable to implement a patch to correct this issue.

AnalysisAI

Server-side request forgery in blender-mcp's ZIP File Handler allows authenticated remote attackers to manipulate the zip_file_url parameter in import_generated_asset_hunyuan, causing the MCP server to issue arbitrary outbound HTTP requests on behalf of the attacker - including to internal network resources such as cloud metadata endpoints. All rolling-release commits up to 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b are affected, per CPE cpe:2.3:a:ahujasid:blender-mcp:*:*:*:*:*:*:*:*. A publicly available exploit exists via GitHub issue #203 (E:P confirmed in CVSS temporal vector), though no CISA KEV listing exists at time of analysis.

Technical ContextAI

blender-mcp is a Model Context Protocol (MCP) server that bridges Blender (the open-source 3D modeling application) with AI-driven asset generation workflows, specifically Hunyuan 3D model generation. The vulnerable code path resides in the import_generated_asset_hunyuan and import_generated_asset_hunyuan_ai functions in src/blender_mcp/server.py and addon.py, where a caller-controlled zip_file_url argument is passed directly to requests.get() without any destination validation. This is a textbook CWE-918 (Server-Side Request Forgery) pattern: the server acts as an unvalidated HTTP proxy, forwarding requests to any destination the attacker specifies, including RFC 1918 private ranges, loopback addresses, and link-local cloud metadata endpoints. The patch (commit 5b37be25242e73dc4cf1328974d30458b9e5d67e) remedies this by introducing validate_url_not_internal() using Python's ipaddress module to block resolution to private, loopback, link-local, and reserved IP ranges, and additionally implements IP pinning after DNS resolution to prevent DNS rebinding (TOCTOU) attacks - a more complete mitigation than naive hostname checking alone.

RemediationAI

The upstream fix is available via PR #205 (https://github.com/ahujasid/blender-mcp/pull/205) and commit 5b37be25242e73dc4cf1328974d30458b9e5d67e (https://github.com/bergskenop/blender-mcp/commit/5b37be25242e73dc4cf1328974d30458b9e5d67e). Since this is a rolling-release project with no tagged versions, users should update their local checkout to a commit at or after 5b37be25. Note that the patch in the bergskenop fork and the PR #205 diff differ slightly in implementation completeness - the PR version additionally implements IP pinning to prevent DNS rebinding, which is the more robust fix. If immediate patching is not feasible, two compensating controls apply: (1) Apply egress firewall rules on the host running blender-mcp to block outbound HTTP/HTTPS requests to RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback, and cloud metadata IPs (169.254.169.254) - trade-off is this is host-level and not code-level, so misconfiguration can leave gaps; (2) Disable the Hunyuan 3D asset generation feature entirely if not in use, which eliminates the vulnerable code path - trade-off is loss of that functionality.