Swagger Testcase Mcp
Monthly
Server-side request forgery in eyaushev swagger-testcase-mcp enables authenticated remote attackers to forge arbitrary server-side HTTP requests through the loadSource function of the fetch_swagger component, potentially reaching internal network resources, cloud metadata endpoints, or other services inaccessible from the attacker's position. All versions under the project's rolling release model are affected at commit 5babb27c951fb404bc2b25ec80593616e49054e5, with no patch or maintainer response confirmed at time of analysis. A public proof-of-concept exploit exists via GitHub issue, though no active exploitation has been confirmed by CISA KEV; the CVSS 4.0 base score of 2.1 reflects limited but real impact across confidentiality, integrity, and availability on the vulnerable system.
Server-side request forgery in eyaushev swagger-testcase-mcp enables authenticated remote attackers to forge arbitrary server-side HTTP requests through the loadSource function of the fetch_swagger component, potentially reaching internal network resources, cloud metadata endpoints, or other services inaccessible from the attacker's position. All versions under the project's rolling release model are affected at commit 5babb27c951fb404bc2b25ec80593616e49054e5, with no patch or maintainer response confirmed at time of analysis. A public proof-of-concept exploit exists via GitHub issue, though no active exploitation has been confirmed by CISA KEV; the CVSS 4.0 base score of 2.1 reflects limited but real impact across confidentiality, integrity, and availability on the vulnerable system.