EUVD-2026-54962
GHSA-g33v-9g6g-xm9p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network-reachable SSRF with partial confidentiality and integrity impact on the vulnerable system; no availability impact and unchanged scope since lateral compromise is not confirmed by available data.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
2DescriptionCVE.org
A security vulnerability has been detected in adafap api-mcp up to 92b9a5d04acfec165c7d4ef852496593aa87be06. This affects the function customAxios of the file app/api/proxy/route.ts of the component Proxy API Endpoint. The manipulation of the argument url leads to server-side request forgery. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Server-side request forgery in adafap's api-mcp Proxy API Endpoint exposes the server as an open proxy, allowing remote unauthenticated attackers to manipulate the url argument passed to the customAxios function in app/api/proxy/route.ts and force the server to issue arbitrary outbound HTTP requests. All commits up to 92b9a5d04acfec165c7d4ef852496593aa87be06 are affected; the project's rolling release model means no discrete patched version exists. The CVSS 4.0 E:P modifier confirms a proof-of-concept exploit exists, and the vendor has not responded to the coordinated disclosure filed via GitHub issue #4.
Technical ContextAI
CWE-918 (Server-Side Request Forgery) describes the root cause: the customAxios function in the Proxy API Endpoint (app/api/proxy/route.ts) accepts an attacker-supplied url value and forwards it as an outbound HTTP request without adequate origin validation, scheme restriction, or allowlist enforcement. api-mcp is a Model Context Protocol (MCP) integration layer - a category of tooling that bridges LLM agents to external APIs - meaning its proxy functionality is likely a core, frequently-used feature rather than an obscure edge case. No CPE string was provided in the intelligence data; the authoritative reference is the adafap/api-mcp GitHub repository. SSRF in proxy-style endpoints is particularly dangerous when the hosting environment has access to cloud instance metadata services (e.g., AWS IMDSv1 at 169.254.169.254) or unguarded internal services, enabling credential exfiltration and network pivoting beyond the initial SSRF.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor was notified via issue report (https://github.com/adafap/api-mcp/issues/4) but has not responded; upstream fix availability should be monitored on the GitHub repository. As an immediate compensating control, implement a strict URL allowlist inside customAxios restricting the url parameter to known trusted domains and HTTPS scheme only, explicitly blocking RFC 1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and link-local addresses (169.254.0.0/16) used by cloud metadata services such as AWS IMDSv1; this eliminates the most dangerous chained-exploitation paths but requires code modification. Alternatively, if the Proxy API Endpoint is not required, disabling or removing the app/api/proxy/route.ts handler entirely eliminates the attack surface with no functional trade-off for workloads that do not use proxying. At the network layer, enforce egress filtering from the api-mcp host to block outbound connections to internal IP ranges and metadata endpoints - this is a defense-in-depth measure that does not fix the underlying flaw but limits blast radius. Organizations using cloud-hosted deployments should also consider enabling IMDSv2 (requiring session-oriented tokens) to mitigate credential theft via SSRF on AWS.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today