How five MCP servers addressed server-side request forgery

Google’s MCP Toolbox for Databases had a server-side request forgery flaw rated 8.0, affecting versions 0.3.0 to 1.4.0. Google, JPMorgan Chase, Weaviate, DINUM and Tangerang’s city government each fixed an SSRF finding in an MCP server. Researcher Syed Anas Mohiuddin reported all five, according to an update he published.

What does SSRF mean here?

Server-side request forgery, or SSRF, happens when a caller can influence a server’s outbound request destination. An MCP server may take a URL, path or endpoint from an AI agent and request that address. If the server does not check where the address resolves, the request may reach internal systems as well as public destinations.

The reported cases concern Model Context Protocol servers, which the source describes as a standard used by AI agents to call tools and data sources. The practical issue is that the server makes the network request, while an agent or the person steering it may influence the destination. The source says the five reports involved organisations with no shared code or owner.

How did the reports begin?

In May, Mohiuddin argued that SSRF could be a structural problem in MCP servers. He suggested that teams working independently could reproduce the same kind of weakness. His later update described findings at five operators and said he had reported each one.

The source does not provide a shared disclosure date for all five findings. It gives specific timing for some details: a high-severity advisory for Tangerang’s Wazuh MCP server was published on 3 September, and Mohiuddin’s account says that Google, JPMorgan Chase, Weaviate and DINUM also fixed their findings. The reports therefore document separate fixes, rather than one common patch.

What changed in Google’s product?

Google’s MCP Toolbox for Databases used an HTTP client without a restrictive redirect policy or a check of target IP addresses, according to the GitHub advisory. A crafted path parameter could send requests to internal or external endpoints. The issue was identified as CVE-2026-14540 and rated high at 8.0, with affected versions from 0.3.0 to 1.4.0.

Google added a guard against DNS rebinding and lists of allowed and blocked IP ranges. The advisory credited Mohiuddin. In plain terms, the change adds checks intended to prevent a hostname or request path from directing the server towards an unintended network address.

What did the other organisations fix?

JPMorgan Chase’s open-source documentation-search server had two tools that fetched content. Mohiuddin said one checked domains against an allowlist, while the other fetched a caller-supplied URL; JPMorgan Chase’s Responsible Disclosure team confirmed the issue and deployed a fix. He described that finding as medium severity.

Weaviate limited endpoint settings in its Google module to Google API hosts, according to the report. DINUM’s official MCP server for France’s open-data platform had fetched URLs supplied by data producers, including possible internal or cloud metadata addresses. Its fix was titled “harden SSRF on external APIs” and credited Mohiuddin.

Tangerang’s Wazuh MCP server rejected literal IP addresses as its SSRF protection but did not resolve hostnames, according to a high-severity advisory. That distinction matters because a hostname can refer to an address that a literal-IP check never evaluates. The source does not give a numeric severity score for this finding.

What remains unclear?

The source confirms that the five named organisations fixed their reported findings, but it does not say whether every affected deployment has applied the repairs. It also gives detailed version information only for Google’s MCP Toolbox for Databases. Readers should look for further advisories or upgrade guidance from the named operators.

On 2 September, Mohiuddin privately reported issues in five MCP servers under the US General Services Administration’s Technology Transformation Services. The listed services included Veterans Affairs benefits claims, CMS Blue Button, regulations.gov, USASpending and CDC PLACES. The available source text ends before describing their status, so whether those issues have been fixed remains unanswered.