CVE-2026-10661 Overview
CVE-2026-10661 is an injection vulnerability in the ahujasid/blender-mcp project, an open-source Model Context Protocol (MCP) server that bridges large language models with Blender. The flaw exists in the Open function within src/blender_mcp/server.py, where the input_image_url argument is processed without adequate validation. A remote attacker with low privileges can manipulate this argument to inject content into downstream operations. The issue is tracked under CWE-74 (Improper Neutralization of Special Elements in Output). The project follows a rolling release model, and a patch is available as commit 5b37be25242e73dc4cf1328974d30458b9e5d67e.
Critical Impact
Remote exploitation is possible with low privileges, and exploit details are publicly disclosed, raising risk for any deployment of blender-mcp exposed to untrusted input.
Affected Products
- ahujasid/blender-mcp up to commit 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b
- Affected file: src/blender_mcp/server.py
- Affected function: Open
Discovery Timeline
- 2026-06-02 - CVE-2026-10661 published to NVD
- 2026-06-02 - Last updated in NVD database
Technical Details for CVE-2026-10661
Vulnerability Analysis
The vulnerability resides in the Open function of src/blender_mcp/server.py. The function accepts an input_image_url argument supplied by an MCP client and passes it into a downstream operation without proper neutralization. Because the value is treated as trusted, an attacker can supply crafted input that alters the meaning of the resulting command or request. This pattern matches CWE-74, where untrusted data is embedded into a controlled context without sanitization. The flaw is reachable over the network and requires only low privileges. Public disclosure of the exploit increases the likelihood of opportunistic attempts against exposed blender-mcp instances.
Root Cause
The Open function does not validate or sanitize the input_image_url parameter before use. Acceptable values are not constrained to a strict URL schema, and special characters that influence downstream parsers are not neutralized. This allows attacker-supplied data to escape its intended context and inject additional directives.
Attack Vector
An attacker delivers a crafted input_image_url value to the MCP server through a client request to the Open tool. The malicious value is processed by the vulnerable function, where the injected payload changes the behavior of the request handler. Exploitation requires network access to the blender-mcp server and low-privilege access to invoke the tool.
A verified proof-of-concept is not published in the available references. For technical specifics, see the upstream GitHub Issue #202, Pull Request #205, and the patch commit.
Detection Methods for CVE-2026-10661
Indicators of Compromise
- Requests to the MCP Open tool containing input_image_url values with shell metacharacters, URL-encoded payloads, or non-HTTP schemes such as file:// or data:.
- Unexpected child processes spawned by the blender-mcp server process during or shortly after Open invocations.
- Outbound network connections from the Blender host to attacker-controlled domains following MCP requests.
Detection Strategies
- Audit the deployed src/blender_mcp/server.py for the pre-patch implementation of Open and verify the commit hash against 5b37be25242e73dc4cf1328974d30458b9e5d67e.
- Log all MCP tool invocations with full argument values and review input_image_url parameters for anomalous content.
- Implement allow-list validation at a proxy layer in front of the MCP server to flag non-conforming URL inputs.
Monitoring Recommendations
- Monitor process trees of the blender-mcp host for unexpected interpreters, network utilities, or file operations originating from the server process.
- Forward MCP server logs and host telemetry to a centralized analytics platform such as the Singularity Data Lake for correlation and retrospective hunting.
- Alert on Blender or MCP hosts initiating outbound connections to domains not on a known-good list.
How to Mitigate CVE-2026-10661
Immediate Actions Required
- Update blender-mcp to a revision that includes commit 5b37be25242e73dc4cf1328974d30458b9e5d67e or later.
- Restrict network access to the MCP server so only trusted clients can reach it.
- Review historical logs for prior invocations of Open with suspicious input_image_url values.
Patch Information
The maintainers addressed the injection through commit 5b37be25242e73dc4cf1328974d30458b9e5d67e, merged via Pull Request #205. Because the project follows a rolling release model, downstream operators must rebuild or redeploy from a source tree that contains the patch commit. Verify the deployed revision with git log against the fixed hash.
Workarounds
- Run blender-mcp only on isolated hosts that do not process untrusted MCP client traffic.
- Enforce strict allow-list validation of input_image_url values at an upstream proxy, accepting only https:// URLs from approved domains.
- Execute the MCP server under a low-privilege account with no shell access to limit the impact of successful injection.
# Configuration example: verify the patched commit is deployed
cd blender-mcp
git fetch --all
git log --oneline | grep 5b37be25242e73dc4cf1328974d30458b9e5d67e || \
echo "WARNING: patch commit not present - update required"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
