EUVD-2026-54908
GHSA-jgm8-jqmm-5rc5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable SSRF with low-privilege auth (PR:L); scope changed (S:C) because the server proxies requests to other systems; no availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in aliyun alibabacloud-dataworks-mcp-server up to 1.0.43. The impacted element is the function ReadResourceRequestSchema of the file src/resources/initResources.ts. The manipulation of the argument request.params.uri results in server-side request forgery. The attack may be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Server-Side Request Forgery in Alibaba Cloud's alibabacloud-dataworks-mcp-server (versions up to 1.0.43) enables authenticated remote attackers to manipulate the server into issuing arbitrary HTTP requests to internal or external targets. The vulnerability resides in the ReadResourceRequestSchema function within src/resources/initResources.ts, where the request.params.uri argument is accepted without sufficient validation or restriction. A proof-of-concept exploit exists (CVSS 4.0 E:P), no vendor patch has been released as of disclosure, and the project maintainer had not responded to the issue report at time of filing.
Technical ContextAI
The affected component is the Model Context Protocol (MCP) server implementation for Alibaba Cloud DataWorks, a cloud-based data integration and analytics platform. MCP servers expose resources and tools to LLM-based AI agents. The vulnerable function, ReadResourceRequestSchema, processes resource URIs supplied by the caller at request.params.uri - a parameter path that feeds directly into downstream HTTP or resource-fetch logic without proper allowlist validation or scheme restriction. CWE-918 (Server-Side Request Forgery) describes exactly this class of flaw: unsanitized user-controlled URIs that cause the server to act as a proxy, potentially reaching internal services, metadata endpoints (e.g., cloud IMDSv1), or other intranet hosts inaccessible to the attacker directly. The CPE string cpe:2.3:a:aliyun:alibabacloud-dataworks-mcp-server identifies the affected software as the aliyun npm package.
RemediationAI
No vendor-released patch has been identified at time of analysis - the project maintainer had not responded to the responsible disclosure issue. As a compensating control, restrict which principals can invoke the MCP server's ReadResource endpoint; if the server operates behind an API gateway or proxy, apply an allowlist of permitted URI schemes (e.g., allow only https:// and specific hostnames) at the network layer before the request reaches the application. Disable or firewall access to cloud instance metadata services (e.g., block 169.254.169.254 at the host or container network level) to prevent credential theft via SSRF, noting this may break legitimate IMDS-dependent functionality. Additionally, deploy egress filtering on the host running the MCP server to restrict outbound connections to known DataWorks service endpoints only. Monitor the GitHub repository at https://github.com/aliyun/alibabacloud-dataworks-mcp-server for patch availability and apply as soon as a fixed release is published.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today