EUVD-2026-97143
GHSA-fcpg-mvxf-m2gh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege MCP tool access
-
DeliverySupply attacker-controlled audit URL
-
Exploitrun_seo_audit issues server-side request
-
ExecutionReach internal/restricted endpoint
-
ImpactDisclose or interact with internal resource
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to be able to invoke the run_seo_audit function of the Crawler component with an attacker-controlled target URL, which per the CVSS vector demands low-level privileges (PR:L) on the seo-crawler-mcp server - i.e. legitimate access to the MCP tool interface. No user interaction is needed (UI:N) and complexity is low (AC:L). The principal limiting factors are the authentication/tool-invocation requirement and the low technical impact (read/limited interaction with reachable back-end services, no scope change); realistic risk is highest where the MCP server has network reach to sensitive internal endpoints (e.g. cloud metadata or internal APIs) and lacks URL/egress filtering. |
| Impact | This is a low-priority issue despite being network-reachable. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a remotely reachable, low-complexity flaw, but all three impact metrics are only Low (VC:L/VI:L/VA:L) and there is no scope/subsequent-system impact (SC:N/SI:N/SA:N), yielding a base score of just 2.1. Crucially, PR:L means the attacker must already hold low-level privileges on the MCP server (i.e. the ability to invoke the run_seo_audit tool), which is a meaningful barrier for an SSRF. Exploitation status is 'publicly available exploit code exists' - the disclosure references a public PoC (Net-defense/public_exp) consistent with the E:P (Proof-of-Concept) temporal marker - but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation. The SSVC/automatable and technical-impact framing is not supplied in the input. Net: a genuine but low-severity SSRF in a niche developer tool; it does not rise to emergency-patch priority, and the authenticated requirement plus low technical impact argue against mass exploitation. Note the vendor did not respond to disclosure, so no official fix or affected-version confirmation is available. |
| Exploit ScenarioDerived | An authenticated user of the seo-crawler-mcp server (a Model Context Protocol tool) invokes run_seo_audit with an attacker-chosen target, causing the server to issue HTTP requests to that destination. By pointing the audit at internal-only addresses (e.g. cloud metadata endpoints or internal services), the attacker coerces the server into reaching resources it should not, with low-level confidentiality/integrity/availability impact. A public proof-of-concept for this behavior has been disclosed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Server-side request forgery in houtini-ai seo-crawler-mcp through version 2.1.5 allows an authenticated caller of the MCP tool interface to coerce the Crawler component into issuing requests to arbitrary destinations through the run_seo_audit function in src/core/CrawlOrchestrator.ts. The vendor was contacted about the flaw but did not respond, so there is no upstream fix at time of analysis, and publicly available exploit code exists (disclosed via the Net-defense/public_exp reference), though there is no evidence of confirmed active exploitation (not in CISA KEV). The independent assessment rates this low priority: exploitation requires low-level privileges on the MCP server (PR:L per both the vendor CVSS 4.0 vector and the assessed CVSS 3.1 vector), needs no user interaction, and yields only low read-level impact, with real risk concentrated where the MCP server has network reach to sensitive internal endpoints such as cloud metadata or internal APIs and lacks URL/egress filtering.
RemediationAI
No vendor-released patch identified at time of analysis: the vendor was contacted early but did not respond, so there is no fixed version to upgrade to - the closest available information is the VulDB advisory at https://vuldb.com/vuln/416565. Until an upstream fix ships, apply targeted compensating controls. First, restrict or disable the run_seo_audit tool for untrusted callers and treat MCP tool invocation as a privileged capability requiring strong authentication and per-client authorization, since the assessed prerequisite is low-privilege access to that interface; the trade-off is loss of the SEO audit feature for those clients. Second, enforce a strict destination allowlist or denylist inside the crawler input path, rejecting non-HTTP(S) schemes and any host resolving to RFC1918, loopback, link-local (169.254.0.0/16), or IPv6 unique-local ranges, and disable HTTP redirect following or re-validate the destination after each hop; note that aggressive egress filtering can break legitimate crawls of internal or staging sites. Third, block outbound traffic from the MCP server at the network layer or via a forward proxy so it cannot reach metadata endpoints (for example, require IMDSv2 or disable the instance metadata service on AWS, and apply equivalent hardening on other clouds) and internal admin APIs; running the server in a segmented container or namespace with restrictive egress is the most reliable control but may require re-architecting deployments that rely on broad outbound access. Finally, log and review MCP tool invocations and server-side outbound requests for internal-address destinations, using that telemetry to detect abuse and to identify whether the public proof-of-concept at https://github.com/Net-defense/public_exp/issues/1 has been exercised against your environment.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a classic CWE-918 server-side request forgery in the TypeScript/Node.js Model Context Protocol (MCP) server houtini-ai seo-crawler-mcp. The MCP server exposes tools to an agent or client; the run_seo_audit tool in src/core/CrawlOrchestrator.ts accepts a target URL and passes it to the crawler's HTTP fetch layer without validating the resolved destination against an allowlist or blocking private, link-local, and metadata ranges, and apparently without constraining redirect following. Because the request originates from the server rather than the client, it can reach back-end services otherwise unreachable from the attacker's network position, including 169.254.169.254 cloud metadata, localhost-bound admin interfaces, and RFC1918 internal APIs. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, with VC:L/VI:L/VA:L and no scope change) and the independent assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) agree on the key constraints: the route is network-reachable and low-complexity, but the attacker must already hold low-level privileges on the MCP server, meaning legitimate access to the tool interface, and impact is limited to reading/limited interaction with reachable back-end services. The E:P metric and the public_exp reference confirm the availability of proof-of-concept material rather than confirmed in-the-wild exploitation. No CPE strings were supplied, so affected product identification rests on the vendor's own advisory data at vuldb.com/vuln/416565.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Authenticated tool invocation drives PR:L and AC:L; SSRF primarily leaks internal responses (C:L) with no inherent integrity/availability impact and unchanged scope.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability has been found in houtini-ai seo-crawler-mcp up to 2.1.5. Impacted is the function run_seo_audit of the file src/core/CrawlOrchestrator.ts of the component Crawler. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Exploit-DB