EUVD-2026-25925Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable SSRF with no auth; scope changes because server reaches internal systems, but impact limited to partial confidentiality read-only.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability has been found in dmitryglhf mcp-url-downloader up to 4b8cf2de55f6e8864a77d108e8a94a5b8e4394c6. Affected by this issue is the function _validate_url_safe of the file src/mcp_url_downloader/server.py. Such manipulation of the argument url leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Server-Side Request Forgery in dmitryglhf's mcp-url-downloader MCP server allows unauthenticated remote attackers to manipulate the url argument passed to the _validate_url_safe function, causing the server to issue arbitrary outbound HTTP requests on the attacker's behalf. The flaw exposes any internal network resources reachable by the host - including cloud instance metadata endpoints - to external actors with network access to the service. A public proof-of-concept has been disclosed (SSVC: poc, Automatable: yes); the vendor has not yet responded to responsible disclosure, and no patched release exists.
Technical ContextAI
mcp-url-downloader is a Python-based Model Context Protocol (MCP) server designed to fetch remote URLs on behalf of MCP clients, identified at commit 4b8cf2de55f6e8864a77d108e8a94a5b8e4394c6. The vulnerable function _validate_url_safe in src/mcp_url_downloader/server.py is the URL sanitization gate for all download operations. CWE-918 (Server-Side Request Forgery) describes a class of flaws where user-controlled URI inputs are passed to server-side HTTP clients without adequate destination validation, allowing attackers to redirect requests to unintended endpoints such as internal RFC-1918 addresses, loopback interfaces, or cloud IMDS services (e.g., 169.254.169.254). The MCP protocol context means this server likely runs adjacent to LLM infrastructure, increasing the value of SSRF pivots against internal AI pipeline components.
RemediationAI
No vendor-released patch has been identified at time of analysis; the maintainer has not responded to the GitHub issue report at https://github.com/dmitryglhf/url-download-mcp/issues/2. As the primary compensating control, implement strict egress filtering on the host running mcp-url-downloader to block outbound requests to internal RFC-1918 ranges, loopback addresses, and cloud metadata endpoints (169.254.169.254, fd00:ec2::254) - this directly neutralizes the most dangerous SSRF pivot paths while allowing legitimate external URL fetches; trade-off is that overly broad egress rules may break legitimate functionality. Secondarily, restrict network ingress to the MCP server port to trusted client IPs only using host-based firewall rules, reducing the pool of potential attackers. If neither compensating control is feasible, replacing this component with a maintained alternative should be considered. Monitor the referenced GitHub issue for any vendor response or upstream commit that addresses the _validate_url_safe bypass.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today