EUVD-2026-66829
GHSA-77f3-qj56-x322
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed MCP server endpoint
-
DeliverySend unauthenticated raw_sentry_api invocation
-
ExploitSupply crafted internal URL as endpoint argument
-
ExecutionServer issues outbound HTTP request to internal target
-
PersistReceive internal service response
-
ImpactEnumerate internal network or harvest credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The MCP server must be reachable over the network by the attacker - no authentication is required per PR:N in the CVSS 4.0 vector. The raw_sentry_api tool must be accessible to the calling client, which in MCP deployments is typically controlled by the MCP host configuration. No special server-side configuration is required beyond the default installation of version 0.4.0. Exploitation is limited by: the MCP server's network exposure (local-only deployments are not remotely exploitable), egress firewall rules that may block internal destination addresses, and the absence of a direct code execution primitive - impact is confined to SSRF-reachable services rather than arbitrary command execution. |
| Impact | The CVSS 4.0 vector scores 6.9 (Medium) with AV:N/AC:L/AT:N/PR:N/UI:N and impacts rated VC:L/VI:L/VA:L - indicating that unauthenticated remote exploitation is straightforward but individual impact per request is limited. The E:P modifier confirms publicly available exploit code exists, which elevates practical risk above the raw numeric score. No CISA KEV listing is present, so active exploitation at scale is not confirmed. SSRF vulnerabilities in API-proxy tools like this one carry disproportionate real-world risk relative to their CVSS score: successful exploitation can expose cloud metadata credentials, enumerate internal network topology, or pivot to services that trust the server's IP. The product's niche footprint (MCP server for self-hosted Sentry) limits mass exploitation, but any deployment with network-reachable MCP endpoints is concretely at risk. No EPSS data was provided in the source intelligence. |
| Exploit ScenarioDerived | An attacker with network access to an exposed sentry-selfhosted-mcp instance sends a crafted MCP tool invocation to raw_sentry_api with the endpoint parameter set to an internal address such as http://169.254.169.254/latest/meta-data/. The server fetches the resource and returns the response, leaking cloud instance metadata including IAM credentials. A public proof-of-concept demonstrating this technique exists in the project's GitHub issue tracker. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 27, 2026
Server-side request forgery in ddfourtwo sentry-selfhosted-mcp 0.4.0 allows remote unauthenticated attackers to manipulate the endpoint argument in the raw_sentry_api component, causing the server to issue arbitrary HTTP requests to internal or external hosts. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, and a public exploit exists via a GitHub issue report. No patch has been released - the project maintainer has not responded to the coordinated disclosure.
RemediationAI
No vendor-released patch has been identified at time of analysis - the maintainer had not responded to the issue report (https://github.com/ddfourtwo/sentry-selfhosted-mcp/issues/2) at time of disclosure. As a primary compensating control, restrict network access to the MCP server so that only trusted AI orchestration clients can invoke raw_sentry_api; deploying a firewall or VPC security group rule to block inbound connections from untrusted sources eliminates the remote unauthenticated attack vector at the cost of reduced accessibility. Additionally, configure egress filtering on the host running sentry-selfhosted-mcp to block outbound connections to RFC-1918 private ranges and cloud metadata addresses (169.254.169.254, fd00::/8), which prevents the most impactful SSRF pivots while permitting legitimate Sentry API calls. Monitor the GitHub repository for a patched release and prioritize upgrading once available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
sentry-selfhosted-mcp is an MCP (Model Context Protocol) server designed to bridge AI tooling with self-hosted Sentry error-tracking instances. The vulnerable component, raw_sentry_api, exposes an endpoint parameter that is passed to outbound HTTP client calls without sufficient validation or allowlist enforcement - the textbook CWE-918 (Server-Side Request Forgery) pattern. An attacker who can invoke this MCP tool with a crafted endpoint value can redirect the server's HTTP client to arbitrary internal addresses, cloud metadata endpoints (e.g., 169.254.169.254), or other services reachable from the server's network. The CPE string cpe:2.3:a:ddfourtwo:sentry-selfhosted-mcp covers all versions, with version 0.4.0 explicitly confirmed as affected by VulDB.
Know when Sentry Selfhosted Mcp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable, no auth or interaction required; limited CIA impact consistent with SSRF without code execution or scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A security flaw has been discovered in ddfourtwo sentry-selfhosted-mcp 0.4.0. The affected element is an unknown function of the component raw_sentry_api. The manipulation of the argument endpoint results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Exploit-DB