Sentry Selfhosted Mcp
Monthly
Server-side request forgery in ddfourtwo sentry-selfhosted-mcp 0.4.0 allows remote unauthenticated attackers to manipulate the endpoint argument in the raw_sentry_api component, causing the server to issue arbitrary HTTP requests to internal or external hosts. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, and a public exploit exists via a GitHub issue report. No patch has been released - the project maintainer has not responded to the coordinated disclosure.
Server-side request forgery in ddfourtwo sentry-selfhosted-mcp 0.4.0 allows remote unauthenticated attackers to manipulate the endpoint argument in the raw_sentry_api component, causing the server to issue arbitrary HTTP requests to internal or external hosts. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, and a public exploit exists via a GitHub issue report. No patch has been released - the project maintainer has not responded to the coordinated disclosure.