Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →A security researcher says five organizations fixed related server-side request forgery (SSRF) flaws in their Model Context Protocol (MCP) servers: Google, JPMorgan Chase, Weaviate, France’s DINUM and the government of Tangerang City, Indonesia. The October 5, 2026, account from Unite.AI describes the cases as separate implementation bugs—not a flaw demonstrated in the MCP protocol itself. The report is a secondary account; the underlying advisories and fixes have not been independently verified here.
What was the MCP SSRF flaw?
Server-side request forgery occurs when a server makes an outbound request to a destination influenced by a user or, in these cases, by an agent or tool input, without adequately controlling where that destination leads. An MCP server may have network access to services that the person interacting with an agent cannot reach directly. If the server accepts an unsafe URL or endpoint, an attacker may be able to make it contact internal systems or arbitrary external hosts.
As an Amazon Associate I earn from qualifying purchases.
According to Unite.AI’s report, researcher Syed Anas Mohiuddin found variations of this pattern in five independently maintained MCP implementations. That recurrence supports a practical warning about how developers validate agent-influenced destinations; it does not establish that the MCP specification itself is vulnerable.
Which organizations were affected, and what did they change?
The case details below are attributed to the Unite.AI report published October 5, 2026. The underlying advisories, code changes and organizational acknowledgments were not available for independent confirmation in the account used here.
#1 Best Overall
| Organization or project | Reported issue | Reported response |
|---|---|---|
| Google MCP Toolbox | The report says generic HTTP source and tool components in versions 0.3.0 through 1.4.0 were affected by an SSRF vulnerability associated with CVE-2026-14540. It attributes a CVSS score of 8.0 to the advisory. | The report says the fix shipped in version 1.5.0 and included an SSRF guard, destination-IP checks, configurable network restrictions and validation of the configured base URL. |
| JPMorgan Chase | A documentation-search MCP server reportedly restricted the domain used by one tool, while a related tool fetched a caller-supplied URL without the same restriction. | The report says the bank’s responsible-disclosure team confirmed the finding and deployed a fix. |
| Weaviate | The report describes unsafe control of endpoint, region and location settings for a Google module. | It says a change restricted those settings to Google API hosts and that Mohiuddin appeared in a public security-recognition entry. |
| France’s DINUM / data.gouv.fr MCP project | A producer-supplied documentation URL reportedly could target loopback, private-network or cloud-metadata addresses. DNS rebinding and redirects were also identified as risks. | The reported fix validates destination IP addresses at connection time, checks redirect hops and refuses proxies. |
| Tangerang City government, Indonesia | The report says a protection check rejected literal private IP addresses but did not resolve hostnames that pointed to private, loopback or link-local addresses. | It reports that the project was patched and credits Mohiuddin as the reporter. |
The version range, score, fix status and technical details in this table are claims reported by Unite.AI, not independently confirmed findings. In particular, the account does not provide primary-source links that would allow readers to verify the advisories or patches directly.
Why hostname checks, DNS and redirects matter
Blocking obvious private IP addresses is not enough if a server accepts hostnames. A hostname can resolve to a private or otherwise sensitive address, and DNS rebinding can make the address returned during an initial check differ from the one used when the connection is made. Redirects create another opportunity to change destinations after the original URL has been accepted.
The remediation approaches described in the report point to several useful review questions for MCP server developers:
- Does the server resolve hostnames and check the resulting addresses, rather than only rejecting literal IP strings?
- Are destination checks tied to the actual connection to address DNS rebinding?
- Does the server validate every redirect destination, or disable redirects where they are unnecessary?
- Are loopback, private-network and link-local ranges blocked or explicitly allowlisted according to the service’s needs?
- Can proxy settings bypass the destination policy?
These are security-review considerations, not a complete cross-vendor comparison: the report provides examples but does not establish that every implementation uses the same controls or threat model.
Rank #3
Other findings in the report are separate from the five SSRF cases
Upstream error data and logging
The account also describes unsafe handling of upstream data, including full API error responses being written to centralized logs without redaction. That is a data-handling concern, not itself the same vulnerability class as SSRF. The report attributes a related concern to federal MCP servers, but does not establish that the affected systems or findings were publicly confirmed.
Five U.S. federal findings reportedly remain in private triage
Mohiuddin told Unite.AI that five findings in U.S. federal MCP servers remained in private triage, unfixed and unconfirmed as outcomes. They should not be counted among the five reported fixed cases or described as confirmed vulnerabilities. The account withholds further code-level detail.
Rapid7 Bulk Export MCP: a separate GraphQL issue
Unite.AI separately reports a GraphQL query-injection issue in Rapid7 Bulk Export MCP, associated with CVE-2026-97228. The report lists versions 0.2.5 through 0.6.1 as affected, version 0.6.2 as fixed, and a CVSS 3.1 score of 2.7. It says the issue was limited to the operator’s own API scope. This is a different vulnerability class and is not part of the five-organization SSRF count; these version and scoring details are report-attributed rather than independently verified here.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Microsoft Playwright MCP concern
The report also recounts an earlier concern involving an agent-supplied navigation URL in Microsoft’s Playwright MCP and possible access to instance metadata. It says there was no CVE or vendor confirmation and presents the severity as the researcher’s own assessment. That account should not be treated as a confirmed case in the five-fix tally.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What Mohiuddin means by “Protocol Pivoting”
Mohiuddin uses “Protocol Pivoting” to describe a possible escalation across protocols when systems trust each other’s inputs. In the example summarized by Unite.AI, instruction-like text appears in MCP tool output; an orchestrator passes it to an A2A subagent as ordinary delegation, and the subagent acts on it. The term is the researcher’s framing, not a formal standards definition.
The report says a preprint titled “Protocol Pivoting: Cross-Protocol Attack Escalation in Agentic AI Systems” appeared on Zenodo on May 24, 2026, and outlines three scenarios: MCP-to-A2A privilege escalation, A2A-to-MCP capability injection, and cross-protocol prompt-injection chains. The preprint itself was not available for independent review here, so those scenarios should be understood as the account’s description rather than verified findings.
How to interpret the reported tally
The headline’s five cases refer to the related SSRF findings that Unite.AI says were confirmed and fixed across Google, JPMorgan Chase, Weaviate, DINUM and Tangerang City. The article’s broader tally also mentions two published CVEs and five federal findings in private triage; neither number changes the five-case SSRF count. Because the primary advisories and acknowledgments were not included in the available account, the safest reading is that these are reported disclosure and remediation outcomes, not independently verified status statements.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
