CVE-2026-10662: Blender-MCP SSRF Vulnerability

CVE-2026-10662 Overview

CVE-2026-10662 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in the ahujasid/blender-mcp project, a Model Context Protocol (MCP) integration for Blender. The flaw resides in the requests.get call within src/blender_mcp/server.py, where the zip_file_url argument passed to the ZIP File Handler component is not validated before issuing an outbound HTTP request. An authenticated remote attacker can coerce the server into making arbitrary requests to internal or external endpoints. The project uses a rolling release model, so specific version ranges are not enumerated. The fix is tracked in commit 5b37be25242e73dc4cf1328974d30458b9e5d67e.

Critical Impact
An attacker with low privileges can force the blender-mcp server to issue unauthenticated requests to attacker-chosen URLs, enabling reconnaissance of internal network resources and metadata services.

Affected Products

ahujasid blender-mcp (rolling release through commit 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b)
Component: ZIP File Handler in src/blender_mcp/server.py
Affected function: requests.get invoked with the zip_file_url argument

Discovery Timeline

2026-06-02 - CVE-2026-10662 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-10662

Vulnerability Analysis

The blender-mcp server exposes functionality to download and process ZIP archives referenced by a URL supplied through the MCP interface. The zip_file_url parameter is forwarded directly to requests.get without scheme allowlisting, host validation, or filtering of private and link-local address ranges. As a result, the HTTP client running on the server will dereference any URL the caller specifies, including http://127.0.0.1, http://169.254.169.254, and other internal addresses.

The attack is reachable over the network and requires low privileges with no user interaction. The disclosure indicates that exploit details have been published, lowering the barrier to weaponization. Confidentiality, integrity, and availability impacts are each rated low, reflecting the indirect nature of SSRF abuse rather than direct code execution.

Root Cause

The root cause is missing input validation on the zip_file_url argument before passing it to the Python requests library. The handler trusts client-supplied URLs and performs no allowlist, DNS resolution check, or response filtering. This pattern matches [CWE-918: Server-Side Request Forgery].

Attack Vector

An attacker authenticated to the MCP endpoint invokes the ZIP download functionality with a crafted zip_file_url. The server resolves the host, opens a connection, and returns or processes the response body as if it were a ZIP archive. By pointing the URL at cloud metadata endpoints, internal admin panels, or non-HTTP services reachable from the server, the attacker can probe internal infrastructure and potentially exfiltrate response data that surfaces through error messages or archive parsing behavior.

No verified proof-of-concept code is included in the advisory. See the GitHub Issue #203 and GitHub Pull Request #205 for technical context.

Detection Methods for CVE-2026-10662

Indicators of Compromise

Outbound HTTP requests from the blender-mcp process to internal RFC1918 addresses, 127.0.0.0/8, or cloud metadata endpoints such as 169.254.169.254.
Unexpected requests.get activity in application logs referencing non-archive hosts or non-HTTP(S) schemes.
ZIP extraction errors in server.py logs that correlate with requests to non-archive URLs, indicating probing attempts.

Detection Strategies

Inspect MCP request payloads for zip_file_url values containing private addresses, loopback hosts, or metadata service domains.
Correlate process-level network telemetry from the host running blender-mcp against an allowlist of expected external archive providers.
Alert on DNS queries originating from the blender-mcp process for internal zones not normally accessed by the service.

Monitoring Recommendations

Forward application and host network logs to a centralized analytics platform and build queries on zip_file_url parameter values and outbound destinations.
Track baseline outbound connections from the blender-mcp host and flag deviations to new internal subnets or cloud metadata IPs.
Monitor for high-frequency or sequential requests.get activity, which may indicate internal port scanning via SSRF.

How to Mitigate CVE-2026-10662

Immediate Actions Required

Apply commit 5b37be25242e73dc4cf1328974d30458b9e5d67e from the upstream repository or pull the latest rolling release that contains it.
Restrict network egress from hosts running blender-mcp to an allowlist of required archive endpoints.
Block access from the blender-mcp host to cloud instance metadata services and internal management interfaces.

Patch Information

The upstream fix is identified by commit hash 5b37be25242e73dc4cf1328974d30458b9e5d67e. Patch details and the associated pull request are available at GitHub Commit Details and GitHub Pull Request #205. Because the project follows a rolling release model, operators should pin deployments to a commit at or after the fix rather than to a version tag.

Workarounds

Place the blender-mcp service behind an egress proxy that enforces destination allowlisting and blocks RFC1918, loopback, and link-local ranges.
Disable or gate the ZIP download functionality at the MCP layer until the patched commit is deployed.
Require authenticated callers and limit access to the MCP endpoint to trusted networks via firewall rules.

bash

# Example iptables egress restriction for the blender-mcp host
iptables -A OUTPUT -m owner --uid-owner blender-mcp -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner blender-mcp -d 169.254.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner blender-mcp -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner blender-mcp -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner blender-mcp -d 192.168.0.0/16 -j REJECT