CVE-2025-59155: hackmd-mcp SSRF Vulnerability

CVE-2025-59155 Overview

CVE-2025-59155 is a server-side request forgery (SSRF) vulnerability in hackmd-mcp, a Model Context Protocol (MCP) server that integrates HackMD's note-taking platform with AI assistants. Versions from 1.4.0 up to (but not including) 1.5.0 accept arbitrary hackmdApiUrl values through the Hackmd-Api-Url HTTP header or a base64-encoded JSON query parameter without validation. Attackers can redirect outbound API requests to internal network services when the server runs in HTTP transport mode. The stdio transport mode is not affected. The issue is tracked as CWE-918 and fixed in version 1.5.0.

Critical Impact
Unauthenticated attackers can pivot the MCP server into internal networks to reach protected endpoints, perform reconnaissance, and bypass perimeter access controls.

Affected Products

hackmd-mcp versions >= 1.4.0 and < 1.5.0
Deployments running the server in Streamable HTTP transport mode (TRANSPORT=http)
MCP integrations exposing the hackmd-mcp HTTP endpoint to untrusted callers

Discovery Timeline

2025-09-15 - CVE-2025-59155 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59155

Vulnerability Analysis

The hackmd-mcp server exposes the HackMD API to MCP-compatible AI assistants. In HTTP transport mode, callers can specify a per-request HackMD API base URL through the Hackmd-Api-Url HTTP header or a base64-encoded JSON query parameter. The server previously accepted any value and used it directly as the outbound request target.

Because no allowlist or scheme validation gated the destination, attackers can substitute internal URLs. Requests intended for https://api.hackmd.io/v1 are redirected to cloud metadata endpoints, internal service ports, or other reachable hosts in the deployment network. The MCP server acts as a confused deputy, issuing requests from its own network position with its own outbound access rights.

Root Cause

The root cause is missing input validation on a user-controlled URL used for outbound HTTP requests, classified as CWE-918: Server-Side Request Forgery. The HTTP transport handler trusted per-request overrides without restricting hosts, schemes, or ports. The stdio transport mode is unaffected because it does not accept HTTP headers or query parameters.

Attack Vector

An attacker sends an HTTP request to a publicly reachable hackmd-mcp instance and sets the Hackmd-Api-Url header (or the base64-encoded JSON query parameter) to an internal URL. The server proxies the API call to the attacker-supplied destination and returns the response body, enabling reconnaissance of internal HTTP services, cloud metadata retrieval, and access-control bypass against network segmentation.

text

# Patch: env.example additions in hackmd-mcp 1.5.0
 # HackMD API Endpoint URL (defaults to https://api.hackmd.io/v1)
 # HACKMD_API_URL=https://api.hackmd.io/v1

+## -----------------------------------------------------
+## Optional settings for Streamable HTTP transport mode
+## -----------------------------------------------------
+
+# Allowed HackMD API URLs (comma-separated list for security)
+# If not set, defaults to the official HackMD API URL
+# ALLOWED_HACKMD_API_URLS=https://api.hackmd.io/v1,https://your-hackmd-instance.com/api/v1
+
 # Use TRANSPORT=http for Streamable HTTP transport mode
 # TRANSPORT=http

Source: GitHub commit 43936c7. The patch introduces the ALLOWED_HACKMD_API_URLS allowlist enforced by version 1.5.0.

Detection Methods for CVE-2025-59155

Indicators of Compromise

Inbound HTTP requests to hackmd-mcp containing a Hackmd-Api-Url header whose value is not on the operator's allowlist.
Query strings carrying base64-encoded JSON payloads that decode to include a hackmdApiUrl field pointing to non-HackMD hosts.
Outbound connections from the MCP server host to RFC1918 addresses, 169.254.169.254, or loopback interfaces.

Detection Strategies

Log all values passed through the Hackmd-Api-Url header and the base64 JSON query parameter at the reverse proxy, then alert on any host outside the approved API domains.
Correlate MCP server process telemetry with outbound socket destinations to identify egress traffic that does not match api.hackmd.io or sanctioned self-hosted instances.
Baseline the destinations reached by the hackmd-mcp process and alert on new hosts, especially internal ranges and cloud metadata services.

Monitoring Recommendations

Enable HTTP access logging on any reverse proxy fronting hackmd-mcp and retain full request headers and query strings.
Monitor DNS resolutions initiated by the MCP server for internal names or metadata endpoints that should never appear in normal operation.
Track deployed hackmd-mcp versions across environments and alert when hosts remain on the 1.4.x line.

How to Mitigate CVE-2025-59155

Immediate Actions Required

Upgrade hackmd-mcp to version 1.5.0 or later on every host running the HTTP transport.
Configure the ALLOWED_HACKMD_API_URLS environment variable with an explicit comma-separated list of permitted API endpoints.
Restrict egress from the MCP server host so it can only reach the sanctioned HackMD API endpoints.
Audit reverse-proxy logs for prior use of the Hackmd-Api-Url header or base64 JSON overrides to identify possible exploitation.

Patch Information

The fix is delivered in hackmd-mcp1.5.0, which enforces an allowlist of HackMD API URLs and honors the ALLOWED_HACKMD_API_URLS environment variable. See the GitHub Security Advisory GHSA-g5cg-6c7v-mmpw and the patch commit 43936c7 for full details.

Workarounds

Switch the deployment to stdio transport mode, which is not affected by this vulnerability.
Place a reverse proxy in front of hackmd-mcp and strip or filter the Hackmd-Api-Url header and the base64-encoded JSON query parameter.
Apply host-level egress firewall rules so the MCP server can only reach approved HackMD API destinations.

bash

# Configuration example: enforce an allowlist in hackmd-mcp 1.5.0+
export TRANSPORT=http
export HACKMD_API_URL=https://api.hackmd.io/v1
export ALLOWED_HACKMD_API_URLS="https://api.hackmd.io/v1,https://hackmd.internal.example.com/api/v1"

# Optional: strip the override header at a reverse proxy (nginx)
# proxy_set_header Hackmd-Api-Url "";