voice-analyser-mcp EUVD-2026-97144

Exploitation requires the attacker to have low-privilege authenticated access to the voice-analyser-mcp server and to invoke the collect_corpus component, which accepts a user-controlled sitemap_url argument; the crawler's fetch function then requests that URL server-side without adequate validation, enabling SSRF. The limiting factors are: authentication is required (CVSS PR:L - this is not an unauthenticated flaw), the attacker must be able to reach and trigger the collect_corpus / sitemap crawling feature, and the impact is bounded (VC/VI/VA:L with no subsequent-system scope), so it does not by itself yield full internal compromise. Applies to versions up to and including 2.1.1.

This is a genuinely low-priority issue despite being a real, confirmed SSRF (CWE-918). The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) yields only 2.1, and the signals are internally consistent: network-reachable and low-complexity, but requiring low-level authentication (PR:L) and producing only low-severity confidentiality, integrity, and availability impact with no subsequent-system scope change (SC/SI/SA:N). The E:P (Proof-of-Concept) exploit maturity aligns with the description's statement that exploit code is public (the referenced Net-defense/public_exp GitHub issue). This is NOT confirmed active exploitation - there is no CISA KEV listing and no EPSS score in the provided data, so publicly available exploit code must not be conflated with in-the-wild use. The product is voice-analyser-mcp, an obscure open-source Model Context Protocol server, so even a public PoC implies at most opportunistic or research interest rather than mass exploitation. Net: a legitimate finding worth patching, but low real-world risk - the combination of required authentication, low technical impact, and tiny deployment footprint keeps this well below priority thresholds. Note the vendor did not respond to disclosure, so no official advisory or fix confirmation exists.

An authenticated low-privilege user of the voice-analyser-mcp server invokes the collect_corpus functionality and supplies a malicious sitemap_url pointing at an internal address (e.g. a cloud metadata endpoint or internal service). The crawler's fetch function in src/utils/crawler.ts follows the attacker-controlled URL, causing the server to issue requests to unintended internal resources. Public PoC exploit code exists (referenced via VulDB and a public GitHub issue), lowering the barrier to reproduction.