What is the CVSS score of EUVD-2026-33323?

EUVD-2026-33323 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Spring AI MCP Security are affected by EUVD-2026-33323?

Spring AI Community's mcp-security framework contains a network-layer vulnerability in versions before 0.1.9 that could allow attackers to manipulate clients into accessing unauthorized internal…. A patch is available.

How to fix or mitigate EUVD-2026-33323?

Within 24 hours: Use dependency scanning to identify all applications and services using org.springaicommunity:mcp-client-security versions before 0.1.9. Within 7 days: Update all affected instances to version 0.1.9 or later and redeploy applications. Within 30 days: Review internal network access logs during the vulnerability window to assess for exploitation attempts.

Spring AI MCP Security EUVD-2026-33323

| CVE-2026-45609 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-05-18 https://github.com/spring-ai-community/mcp-security

GHSA-qjp4-4jvr-xqg3

SSRF Java

7.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

May 18, 2026 - 14:00 vuln.today

Analysis Generated

May 18, 2026 - 14:00 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 maven packages depend on org.springaicommunity:mcp-client-security (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 0.1.9.

DescriptionGitHub Advisory

Summary

The mcp-security framework fails to implement the mandatory SSRF mitigations outlined in the Model Context Protocol (MCP) security specifications. Specifically, it processes untrusted URLs for OAuth-related discovery and metadata without verifying if the targets are malicious or internal to the network.

This only affects installations with Dynamic Client Registration (DCR) enabled:

properties

spring.ai.mcp.client.authorization.dynamic-client-registration.enabled=true

DCR does not validate URLs exposed by MCP Servers (protected resource metadata URL, authorization server URL) and Authorization Servers (all OAuth2 endpoints).

Workaround

When users need to perform DCR, they may provide their own McpOAuth2ClientManager. Both McpMetadataDiscoveryService and DynamicClientRegistrationService are also affected, if used, users should provide their own subclasses.

Alternatively, users can provide the default implementations of these classes with a RestClient that implements URL filtering through ClientHttpRequestInterceptor.

AnalysisAI

Server-Side Request Forgery in the Spring AI Community mcp-security framework (org.springaicommunity:mcp-client-security versions before 0.1.9) allows remote attackers to coerce the MCP client into issuing HTTP requests to attacker-chosen URLs, including internal network targets. The flaw resides in the OAuth2 Dynamic Client Registration (DCR) flow, which fetches metadata and authorization-server URLs without validating them against SSRF protections required by the MCP security specification. No public exploit identified at time of analysis, but a vendor-confirmed patch is available in version 0.1.9.

Technical ContextAI

The affected component is org.springaicommunity:mcp-client-security, a Spring AI Community library that implements OAuth2 client functionality for the Model Context Protocol (MCP). MCP defines a Dynamic Client Registration flow where the client retrieves protected-resource-metadata URLs from MCP Servers and OAuth2 endpoint URLs (token, authorization, registration) from Authorization Servers. The vulnerable McpMetadataDiscoveryService and DynamicClientRegistrationService classes consume those URLs and dispatch HTTP requests via a Spring RestClient without applying the SSRF mitigations the MCP specification mandates (mitigation-3). This is a textbook CWE-918 Server-Side Request Forgery: untrusted input from an external party becomes the destination of a server-originated request, which an attacker can redirect to internal services (cloud metadata endpoints, intranet hosts, loopback admin interfaces). The fix introduces a new UrlValidator interface with a DefaultUrlValidator that enforces HTTPS, blocks loopback addresses by default, and adds a configuration property spring.ai.mcp.client.authorization.dynamic-client-registration.allow-loopback-addresses for development overrides.

RemediationAI

Vendor-released patch: 0.1.9 - upgrade org.springaicommunity:mcp-client-security to 0.1.9 or later, which adds a UrlValidator that enforces HTTPS and rejects loopback addresses by default for all DCR-related URLs (see https://github.com/spring-ai-community/mcp-security/pull/68 and commit e6b67d8a67cd7acbee6e4c0741c385d62e3ed576). If immediate upgrade is not possible, the vendor-documented workarounds are to disable Dynamic Client Registration by setting spring.ai.mcp.client.authorization.dynamic-client-registration.enabled=false (this removes the ability to auto-register clients and will require a single statically configured ClientRegistration or a custom OAuth2HttpClientTransportCustomizer bean), or to supply a custom McpOAuth2ClientManager bean - and custom subclasses of McpMetadataDiscoveryService and DynamicClientRegistrationService if they are used directly - backed by a RestClient with a ClientHttpRequestInterceptor that performs egress filtering against an allowlist of permitted hosts. At the network layer, restrict outbound traffic from the MCP client process to known authorization-server hosts only, denying access to RFC1918 ranges, link-local 169.254.169.254 (cloud IMDS), and loopback to blunt SSRF impact even if the application-layer fix is delayed. Full advisory: https://github.com/spring-ai-community/mcp-security/security/advisories/GHSA-qjp4-4jvr-xqg3.