EUVD-2026-58529
GHSA-274v-3mgv-hg6c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
No authentication required over the network (AV:N/PR:N); SSRF yields partial internal resource disclosure (C:L) and ability to interact with internal services (I:L) but no availability impact.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was detected in Model Context Protocol mcp-rdf-explorer 1.0.0. Affected is the function explore_url of the file src/mcp-rdf-explorer/server.py of the component MCP Server. Performing a manipulation of the argument url results in server-side request forgery. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Server-side request forgery in mcp-rdf-explorer 1.0.0 exposes any network-accessible instance to unauthenticated remote exploitation via the explore_url function in src/mcp-rdf-explorer/server.py, allowing attackers to coerce the MCP server into issuing arbitrary HTTP requests to internal or restricted targets. Affected deployments in cloud environments are at elevated risk if AWS IMDSv1 or similar metadata services are reachable from the server's network context. A public exploit exists (CVSS 4.0 E:P), no vendor patch is available, and the vendor has not responded to responsible disclosure.
Technical ContextAI
mcp-rdf-explorer 1.0.0 implements a Model Context Protocol (MCP) server designed to explore RDF (Resource Description Framework) linked-data graphs by resolving user-supplied URLs. The vulnerable entry point is the explore_url function in src/mcp-rdf-explorer/server.py, which accepts a url argument and fetches it server-side without adequate origin validation or allowlist enforcement. This maps to CWE-918 (Server-Side Request Forgery): the server acts as an unintended HTTP proxy, forwarding attacker-controlled requests to targets that would otherwise be inaccessible from the attacker's network. MCP servers frequently run in trusted network segments with broad egress permissions, meaning SSRF here may reach cloud metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254), internal APIs, or RFC 1918 services not exposed to the public internet. No CPE string was provided in the source data; affected software is identified solely as mcp-rdf-explorer 1.0.0 per EUVD-2026-58529.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to the responsible disclosure. As the highest-priority compensating control, deploy egress firewall rules on the host running mcp-rdf-explorer to block outbound HTTP/S requests to RFC 1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and link-local addresses (169.254.0.0/16, including AWS IMDS); this prevents the most dangerous SSRF pivot paths but does not eliminate the vulnerability. A tighter control is to restrict the MCP server to an explicit allowlist of trusted RDF endpoint domains at the application or proxy layer - this eliminates SSRF to arbitrary targets but may break legitimate functionality if the tool is used for broad linked-data exploration. If external network access is not required for the deployment use case, place the MCP server in a network-isolated segment with no outbound internet access. Consumers should monitor https://github.com/emekaokoye/mcp-rdf-explorer/issues/3 and https://vuldb.com/vuln/389554 for upstream fixes. Consider forking and patching explore_url to validate the url argument against an allowlist until an official fix is released.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today