Which versions of mcp-webresearch are affected by EUVD-2026-46421?

The mcp-webresearch MCP server (version 0.1.7) contains a server-side request forgery vulnerability allowing attackers to reach internal networks, cloud metadata services, and credential repositories…. A patch is available.

How to fix or mitigate EUVD-2026-46421?

Within 24 hours, identify and document all deployments of @mzxrai/mcp-webresearch version 0.1.7; isolate affected instances from internal network access if operationally feasible to constrain the SSRF attack surface. Within 7 days, apply the vendor-released patch to all instances and validate in staging that private IP ranges (including 169.254.169.254 and link-local addresses) are now rejected by the URL validation logic. Within 30 days, audit logs for exploitation attempts against internal endpoints, review LLM interaction histories for suspicious requests to metadata services or internal IPs, and rotate any credentials that may have been accessed through the compromised tool.

mcp-webresearch EUVD-2026-46421

Q: What is the CVSS score of EUVD-2026-46421?

EUVD-2026-46421 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-65056 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-21 VulnCheck

GHSA-r9hf-v7rm-5h4j

SSRF Mcp Webresearch

8.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.2 HIGH

Network-reachable SSRF triggered via LLM prompt injection (UI:R), no auth to the server (PR:N); scope changes as it reads a separate internal system (S:C), yielding high confidentiality and low integrity impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 21:38 vuln.today

CVE Published

Jul 21, 2026 - 20:48 cve.org

HIGH 8.3

DescriptionCVE.org

mcp-webresearch 0.1.7 contains a server-side request forgery vulnerability that allows attackers to access internal network services by supplying loopback, link-local, or cloud metadata addresses to the visit_page tool, which only validates the URL protocol without filtering private or reserved IP ranges. Attackers can steer the LLM-controlled URL argument through prompt injection to navigate the server's Playwright browser to internal endpoints such as cloud instance metadata services, causing the server to return sensitive internal page content including credentials into the model context.

AnalysisAI

Server-side request forgery in the mcp-webresearch MCP server (version 0.1.7, package @mzxrai/mcp-webresearch) lets remote attackers reach internal-only network services by feeding loopback, link-local, or cloud metadata addresses to the visit_page tool. Because the tool validates only the URL scheme and never filters private or reserved IP ranges, an attacker who influences the LLM-controlled URL - typically via prompt injection - can drive the server's Playwright browser to endpoints like 169.254.169.254 and exfiltrate credentials and other sensitive internal content back into the model context. No public exploit identified at time of analysis, though a detailed technical write-up exists and the issue is disclosed by VulnCheck; there is no CISA KEV listing.

Technical ContextAI

The affected component is an MCP (Model Context Protocol) server that gives an LLM web-research capabilities by driving a headless Playwright/Chromium browser. The visit_page tool accepts a URL argument that the model controls at runtime. The root cause is CWE-918 (Server-Side Request Forgery): input validation is limited to checking the URL protocol (e.g. http/https) and performs no destination-address allow/deny-listing, so RFC1918 private ranges (10/8, 172.16/12, 192.168/16), loopback (127/8), link-local (169.254/16), and cloud metadata IPs are all reachable. In cloud deployments this exposes the instance metadata service (IMDS) at 169.254.169.254, which on unhardened AWS IMDSv1, GCP, or Azure endpoints can return IAM/role credentials and configuration. The CPE cpe:2.3:a:mzxrai:mcp-webresearch identifies the single affected product.

RemediationAI

Patch available per vendor advisory: upgrade @mzxrai/mcp-webresearch to the latest release published on npm (https://www.npmjs.com/package/@mzxrai/mcp-webresearch); an exact fixed version number is not stated in the provided data, so confirm the patched version on the npm release page before deploying. Until a confirmed fixed version is verified, apply compensating controls: enforce an egress allow-list on the Playwright browser/host so it can only reach intended public research targets, and block outbound access to loopback (127.0.0.0/8), link-local (169.254.0.0/16, including 169.254.169.254), and RFC1918 private ranges at the network or proxy layer - this prevents internal pivoting but will break any legitimate internal-URL use case. In cloud environments, enforce IMDSv2 (require session tokens and hop-limit 1) or disable the metadata endpoint to neutralize credential theft, and scope the instance/service-account role to least privilege so a successful SSRF yields minimal secrets. Additionally, treat all fetched web content as untrusted to reduce prompt-injection leverage over the URL argument. Reference VulnCheck's advisory at https://www.vulncheck.com/advisories/mcp-webresearch-server-side-request-forgery-in-visit-page-due-to-missing-internal-ip-filtering for details.