Who is the attacker? It may be someone who controls a page or document an AI model reads. If malicious content steers the model into passing a URL to an MCP server, that server may make a request from its own network position and with its own credentials. That is the core server-side request forgery (SSRF) risk in four cases involving Google MCP Toolbox for Databases, Anthropic’s reference fetch server, Microsoft’s Playwright MCP server, and Weaviate’s Google modules. A model call is not trustworthy merely because it came from the expected model; the security boundary is the destination the server actually contacts.
How can an MCP server SSRF happen?
SSRF occurs when a server is induced to send a request to a destination chosen or influenced by an attacker. In an MCP setup, a fetch-capable server or browser tool can have access to loopback services, private networks, cloud metadata endpoints, or credentials that an outside attacker cannot reach directly. Prompt injection can try to persuade the model to use a tool with an attacker-influenced URL.
As an Amazon Associate I earn from qualifying purchases.
This does not make exploitation automatic. The result depends on the server’s network access, available credentials, tool permissions, and whether the model follows the malicious instruction. But checking only that a URL came from an expected configuration field or model-facing tool schema is not enough: the server’s eventual network destination matters.
What went wrong in the four cases?
| Project | Reported trust-boundary failure | Status established by the cited records |
|---|---|---|
| Google MCP Toolbox for Databases | The generic HTTP source reportedly allowed SSRF through the initial destination and redirects. | Repository PR #3448 documents a guard with connection and redirect IP validation. It merged June 18, 2026; linked release notes show version 1.5.0 dated that day. The researcher reports affected versions 0.3.0–1.4.0 for CVE-2026-14540. |
Anthropic reference mcp-server-fetch |
The May disclosure describes URL fetching without internal-address filtering and a separate get_prompt path that called fetch_url() without the autonomy check. |
The NVD record CVE-2026-104120, modified October 6, 2026, lists mcp-server-fetch and mcp-server-everything through version 2026.6.4 and says the fix pull request awaits acceptance. The inspected record does not establish a released fixed version. |
Microsoft playwright-mcp |
Issue #1626 describes arbitrary URLs passed to browser_navigate and the possibility of navigating to internal endpoints. |
The issue is closed, but the inspected page does not document a merged code fix or a release containing one. Closure alone does not establish remediation. |
| Weaviate Google modules | The researcher says earlier hardening covered fields named baseURL, while these modules used apiEndpoint; a controlled endpoint could expose an operator’s Google API key or GCP OAuth token. |
PR #12961 merged September 7, 2026, into stable/v1.37. It restricts Google module apiEndpoint, region, and location to Google API hosts. The cited record does not establish a release version containing the change. |
Google: redirects can change the destination
A destination check that accepts the initial URL but follows an unchecked redirect can still send a server to an unintended address. The Google repository’s PR #3448 documents validation of both the connection IP and redirect destinations. Syed Anas Mohiuddin’s September 2026 article reports CVE-2026-14540, affected versions 0.3.0 through 1.4.0, a CVSS 4.0 score of 8.0, and a July 31, 2026 publication date. The score and date are attributed here to the researcher; the NVD search record also identifies the affected version range.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Anthropic: a second handler can bypass the main guard
The May 25, 2026 Full Disclosure advisory describes arbitrary URL fetching without internal-address filtering in the reference server. It also identifies a distinct prompt route: Mohiuddin wrote that “The get_prompt handler calls fetch_url() directly without invoking check_may_autonomously_fetch_url(), bypassing the robots.txt autonomy guard through a structurally distinct code path (logic bypass).” This is his description of the finding, not a statement that every deployment was exploitable.
The later NVD record is the more current status anchor: CVE-2026-104120 covers mcp-server-fetch and mcp-server-everything through version 2026.6.4, identifies CWE-918, and says the fix pull request awaits acceptance. It lists a CVSS-BT 5.5 score from VulDB; that is separate from the researcher-assigned 7.5 score for the May disclosure involving the Anthropic and Microsoft cases. Issue #4116 in the reference servers repository is closed as not planned. Its author raised defense-in-depth concerns, not a confirmed exploit in a particular deployment.
Microsoft: browser navigation is also a network request
Issue #1626, opened May 22, 2026, describes how an arbitrary URL passed to browser_navigate could lead the browser tool toward internal endpoints. The issue is currently closed, but the inspected record does not show a merged fix or identify a release that contains one. Treat the remediation status as unestablished from that page rather than inferring a fix from the closure label.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
Weaviate: a different field name escaped a control
The reported gap was not limited to redirects or a secondary fetch handler. Mohiuddin says earlier hardening checked fields named baseURL, while Google modules accepted an apiEndpoint. If an attacker could control that endpoint, the researcher says an operator’s Google API key or GCP OAuth token could be exposed. Weaviate PR #12961 merged into stable/v1.37 on September 7, 2026, and restricts the Google module endpoint, region, and location to Google API hosts. A merged change is evidence of a code fix; the cited record does not establish which released version includes it.
Which fixes and statuses are actually established?
Dates and repository states are easy to overread. A merged pull request documents a code change, while a release note identifies a version; neither should be inferred from an issue being closed. As of the latest inspected status, the evidence differs by project:
- Google: PR #3448 merged June 18, 2026, and the linked release notes show version 1.5.0 on that date.
- Weaviate: PR #12961 merged September 7, 2026, into
stable/v1.37; the cited record does not identify a released version containing it. - Anthropic reference servers: the NVD record modified October 6, 2026, lists affected versions through 2026.6.4 and says the fix pull request awaits acceptance; no released fixed version is established there.
- Microsoft: issue #1626 is closed, but the inspected issue page does not document a merged fix or a fixed release.
The May advisory’s broad statement that all versions were affected “as of May 2026” should not be reused as a current verified range where later versioned evidence exists. For Google, the researcher reports a specific affected range; for the Anthropic-related CVE, the later NVD record names versions through 2026.6.4.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
What should MCP operators and maintainers check?
Apply the same security policy to every route that can cause a network request. A primary tool method may be protected while a prompt handler, secondary tool, or browser navigation path is not.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Inventory every network-capable entry point. Include tools, prompts, secondary handlers, and any browser or fetch route. Trace where each URL comes from and which code path performs the request.
- Constrain schemes and destinations. Permit only schemes the use case needs, and use destination allowlists where practical. Reject loopback, private, link-local, and other reserved address ranges unless there is a documented operational need.
- Validate the address actually used. Resolve names and constrain the address used for the connection, not just the hostname string. This helps reduce DNS rebinding and time-of-check/time-of-use gaps.
- Recheck every redirect. Validate each redirect destination before following it; a safe initial URL does not make every later hop safe.
- Enforce response limits during reads. Apply byte limits while streaming or reading the response, rather than buffering an unbounded body and trimming text afterward.
- Limit network impact independently. Restrict outbound egress and protect cloud metadata services. These controls can reduce harm if an application-level check is missed.
When reviewing an implementation, assess initial URL validation, resolved-IP validation and DNS rebinding resistance, redirect-hop checks, coverage across all handlers, response-size enforcement, and network-level egress and metadata controls. These are useful control dimensions, not a product ranking or benchmark.
What do the reported numbers say—and not say?
In his May 25, 2026 advisory, Mohiuddin reported that 27.8% of 54 production MCP servers he scanned had HIGH or CRITICAL findings, 8 of 54 (14.8%) had confirmed SSRF findings, and 7 of 54 had credential exposure. Those are results from his scan, not a representative sampling frame for the MCP ecosystem. They should not be treated as an industry-wide prevalence estimate. The advisory also assigned a CVSS 7.5 score to its Anthropic and Microsoft disclosure; that is the researcher’s score, not a vendor-issued rating in the inspected material.
In September 2026, Mohiuddin summarized the shared lesson this way: “In every case, a URL crossed a trust boundary and nobody was standing at the boundary.” The four cases demonstrate recurring failure modes, not proof that every MCP server is vulnerable. The useful test for any deployment is whether every model-influenced destination is checked at the point of connection, across every handler and redirect, with network controls limiting what a mistake can reach.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
