CVE-2026-10280 Overview
CVE-2026-10280 is a Server-Side Request Forgery (SSRF) vulnerability affecting horizon921 mcpilot version 0.1.0. The flaw resides in the MCP API Call Endpoint, specifically in the client/src/app/api/mcp/call/route.ts file. Attackers can manipulate the serverBaseUrl parameter to coerce the server into issuing arbitrary HTTP requests to attacker-chosen destinations. The vulnerability is exploitable remotely without authentication or user interaction, and a public exploit has been released. The project maintainer has been notified through an issue report but has not yet responded.
Critical Impact
Unauthenticated remote attackers can abuse the serverBaseUrl parameter to perform SSRF attacks, potentially reaching internal services, cloud metadata endpoints, or other resources accessible from the application server.
Affected Products
- horizon921 mcpilot 0.1.0
- Component: MCP API Call Endpoint (client/src/app/api/mcp/call/route.ts)
- Parameter: serverBaseUrl
Discovery Timeline
- 2026-06-01 - CVE-2026-10280 published to NVD
- 2026-06-02 - Last updated in NVD database
Technical Details for CVE-2026-10280
Vulnerability Analysis
The vulnerability is classified as Server-Side Request Forgery under [CWE-918]. The MCP API Call Endpoint in client/src/app/api/mcp/call/route.ts accepts a serverBaseUrl argument supplied by the client. The application uses this value to construct outbound HTTP requests without validating the destination host, scheme, or address range. As a result, an attacker can direct the server to connect to arbitrary endpoints, including loopback interfaces, internal RFC1918 networks, link-local addresses such as 169.254.169.254, and other services not intended to be exposed.
The exploit has been published, lowering the barrier to weaponization. With an EPSS score of 0.045%, active mass exploitation probability is currently low, but targeted abuse against exposed deployments remains feasible.
Root Cause
The root cause is the absence of input validation and destination allow-listing for the serverBaseUrl parameter. User-controlled URLs are passed directly to a server-side HTTP client, violating the principle of treating external input as untrusted. There is no scheme restriction, host allow-list, or network segmentation check applied before the outbound request is issued.
Attack Vector
An unauthenticated remote attacker sends a crafted HTTP request to the MCP API Call Endpoint with a malicious value in the serverBaseUrl argument. The server then issues an outbound request to the attacker-specified URL. Attackers can use this to enumerate internal services, retrieve cloud instance metadata, bypass network-level access controls, or interact with non-HTTP services depending on the underlying HTTP client behavior. See the VulDB Vulnerability Details and GitHub Issue Tracker for technical context.
Detection Methods for CVE-2026-10280
Indicators of Compromise
- Outbound HTTP requests from the mcpilot application server to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or loopback addresses.
- Requests from the application server to cloud metadata endpoints such as 169.254.169.254 or metadata.google.internal.
- Unexpected requests to /api/mcp/call containing externally controlled serverBaseUrl values pointing to non-public hosts.
Detection Strategies
- Inspect application logs for /api/mcp/call requests and correlate the serverBaseUrl parameter with the subsequent outbound connection destinations.
- Deploy egress monitoring on the host running mcpilot to flag connections to private, loopback, or metadata IP ranges.
- Add web application firewall (WAF) rules to identify URL parameters resolving to internal or reserved address space.
Monitoring Recommendations
- Centralize application and network egress logs to enable correlation between inbound API calls and outbound HTTP requests.
- Alert on any outbound traffic from the mcpilot host that deviates from an established baseline of legitimate destinations.
- Track repeated probing of /api/mcp/call with varying URL schemes such as file://, gopher://, or http://127.0.0.1.
How to Mitigate CVE-2026-10280
Immediate Actions Required
- Restrict network access to the mcpilot application until a patched version is available, since the project has not yet responded to the disclosure.
- Place the application behind an egress proxy that enforces an allow-list of permitted outbound destinations.
- Block outbound traffic from the application host to cloud metadata services and internal management networks at the network layer.
Patch Information
No official patch is available at the time of publication. The maintainer of horizon921/mcpilot has been notified through the GitHub Issue Tracker but has not responded. Monitor the upstream repository for fixes and apply them once released.
Workarounds
- Validate the serverBaseUrl parameter against an explicit allow-list of permitted hosts and schemes before issuing any outbound request.
- Reject URLs that resolve to private, loopback, link-local, or reserved IP ranges, including IPv6 equivalents.
- Restrict the application service account's network reachability using host firewall rules or Kubernetes NetworkPolicies to limit lateral movement potential.
- Disable or remove the MCP API Call Endpoint in production deployments if it is not required.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
