EUVD-2026-59995
GHSA-28cc-rvx4-c58g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L reflects confirmed authentication requirement; S:U and A:N because SSRF here has no demonstrated scope change or availability impact beyond low-level information exposure.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was identified in graphlit graphlit-mcp-server 1.0.1. This affects the function fetch of the file src/tools.ts of the component ssrf-test Endpoint. Such manipulation of the argument url leads to server-side request forgery. The attack may be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Server-side request forgery in graphlit-mcp-server 1.0.1 allows authenticated remote attackers to manipulate the url argument of the fetch function at the ssrf-test endpoint in src/tools.ts, causing the server to issue arbitrary outbound HTTP requests to attacker-controlled destinations including internal network resources. A public proof-of-concept exists via a GitHub issue report; the vendor has not responded to disclosure and no patch has been released. No public exploit indicates active widespread exploitation, but the POC lowers the technical barrier for abuse.
Technical ContextAI
graphlit-mcp-server is a Model Context Protocol (MCP) server implementation by Graphlit, version 1.0.1, identified by CPE cpe:2.3:a:graphlit:graphlit-mcp-server:*:*:*:*:*:*:*:*. The vulnerability resides in the fetch function within src/tools.ts at an endpoint explicitly labeled ssrf-test. CWE-918 (Server-Side Request Forgery) arises when user-controlled input is passed directly to server-side HTTP request logic without URL validation, allowlisting, or deny-listing. In this class of flaw, the server becomes a proxy for the attacker, potentially reaching RFC-1918 addresses, cloud metadata endpoints (e.g., 169.254.169.254), and other services inaccessible from the attacker's network position. The MCP protocol context means this server likely mediates AI model tool calls, making SSRF particularly relevant when the server operates with access to internal infrastructure.
RemediationAI
No vendor-released patch has been identified at time of analysis - the graphlit project had not responded to the responsible disclosure at the time of reporting. Operators should monitor the GitHub repository at https://github.com/graphlit/graphlit-mcp-server/ and VulDB at https://vuldb.com/cve/CVE-2026-19957 for patch availability. As compensating controls: restrict or disable the ssrf-test endpoint at the application or reverse-proxy layer, since this endpoint appears to be the specific attack surface (trade-off: may affect functionality if tools depend on it); implement an outbound URL allowlist permitting only explicitly required external domains (trade-off: may require application changes); block outbound HTTP/HTTPS to RFC-1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and the cloud metadata endpoint 169.254.169.254 at the network layer (trade-off: none for most deployments, but verify no legitimate internal fetching is required); and restrict access to the graphlit-mcp-server to only trusted authenticated users, leveraging the PR:L authentication barrier as a meaningful control.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today