PromptShopMCP CVE-2026-74842

Exploitation requires the attacker to hold at least low-privilege authenticated access (PR:L per the CVSS 4.0 vector) to invoke the download_image function on the PromptShopMCP Image-Toolkit-MCP-Server. No special non-default configuration is required - the vulnerable function is part of the server's standard image toolkit feature set and is active in default deployments. No user interaction beyond the attacker's own authenticated API call is required (UI:N). Exploitation impact is bounded by what internal, cloud-metadata, or restricted network resources the server can reach from its own network interface; deployments that are internet-only with no internal services reachable will see minimal practical impact. The attack is not exploitable by unauthenticated parties, which limits opportunistic mass scanning risk.

The CVSS 4.0 base score of 2.1 is exceptionally low, reflecting limited per-system impact (VC:L/VI:L/VA:L) with no subsequent-system impact (SC:N/SI:N/SA:N) and the PR:L authentication prerequisite - signals that temper urgency. However, the E:P modifier in the CVSS 4.0 environmental vector confirms publicly available exploit code, which materially lowers the bar for exploitation beyond what the base score implies. No CISA KEV listing means no confirmed widespread in-the-wild exploitation, and EPSS data is not provided in the source intelligence. The true risk is highly deployment-dependent: even a mid-sized municipal IT team in leszno running this MCP server on a network with reachable cloud metadata or internal microservices faces materially greater exposure than the score suggests, since SSRF impact scales with the server's network reachability. The vendor has not responded to responsible disclosure, meaning the remediation timeline is indeterminate. On balance, this is a real but narrowly scoped vulnerability whose priority should be elevated for deployments in cloud-hosted or network-adjacent environments.

An authenticated user of the PromptShopMCP server submits a crafted call to the download_image function with image_url set to an internal target such as http://169.254.169.254/latest/meta-data/iam/security-credentials/ or an internal microservice endpoint. The server issues the request from its privileged network position and returns the response to the attacker, potentially disclosing cloud IAM credentials or internal API data. A public proof-of-concept demonstrating this technique is available in GitHub issue #4.