CVE-2026-10690: DesktopCommanderMCP SSRF Vulnerability

CVE-2026-10690 Overview

CVE-2026-10690 is a server-side request forgery (SSRF) vulnerability in wonderwhy-er DesktopCommanderMCP version 0.2.37. The flaw resides in the readFileFromUrl function within src/tools/filesystem.ts, part of the read_file component. An attacker can manipulate the url argument to coerce the server into issuing requests to attacker-chosen destinations, including internal network resources. The exploit is publicly available, and the issue is remotely reachable over the network. A patch identified by commit hash 53699bebba9950047bca16ac4dc8f0568f596aaa is available and should be applied [CWE-918].

Critical Impact
An authenticated remote attacker can abuse the read_file tool to read from arbitrary URLs, enabling SSRF against internal services, cloud metadata endpoints, and loopback interfaces.

Affected Products

wonderwhy-er DesktopCommanderMCP 0.2.37
src/tools/filesystem.ts — readFileFromUrl function
read_file MCP tool component

Discovery Timeline

2026-06-03 - CVE-2026-10690 published to NVD
2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-10690

Vulnerability Analysis

DesktopCommanderMCP is a Model Context Protocol (MCP) server that exposes filesystem and process tools to AI assistants. The read_file tool accepts either a local path or a URL. When a URL is supplied, the readFileFromUrl function in src/tools/filesystem.ts fetches the resource without validating the scheme or destination host.

Because the fetch occurs from the MCP server process, an attacker controlling the url argument can target resources reachable only from the server. This includes loopback addresses, RFC1918 private ranges, and cloud instance metadata endpoints such as 169.254.169.254. The MCP tool then returns the response body to the caller, completing a read-based SSRF.

Root Cause

The root cause is missing input validation on URLs passed to the file-read primitive. The original implementation did not restrict protocol schemes (file:, ftp:, gopher:) or block requests to internal IP ranges and link-local addresses. Any string parseable as a URL was fetched and returned [CWE-918].

Attack Vector

An attacker who can supply input to the read_file tool — for example, through a compromised prompt, a malicious tool description, or an exposed MCP transport — sets url to an internal target. The server fetches the destination and returns the body. This is exploitable remotely with low privileges and no user interaction.

typescript

// Patch from src/tools/filesystem.ts
// fix(security): prevent SSRF in read_file URL fetching
function validateFetchUrl(rawUrl: string): void {
    let parsed: URL;
    try {
        parsed = new URL(rawUrl);
    } catch {
        throw new Error(`Invalid URL: ${rawUrl}`);
    }

    // Only allow HTTP and HTTPS
    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
        throw new Error(
            `Blocked URL scheme "${parsed.protocol}" — only http: and https: are allowed`
        );
    }
    // Additional checks reject 127.x, 10.x, 172.16-31.x, 192.168.x,
    // 169.254.x.x, ::1, ::, and internal hostnames such as
    // localhost and host.docker.internal.
}

Source: GitHub Commit 53699be

Detection Methods for CVE-2026-10690

Indicators of Compromise

Outbound HTTP requests from the DesktopCommanderMCP process to RFC1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or loopback addresses.
Requests from the MCP process to cloud instance metadata endpoints such as 169.254.169.254 or metadata.google.internal.
Use of non-HTTP schemes (file://, ftp://, gopher://) in read_file tool invocations logged by the MCP server.

Detection Strategies

Audit MCP server logs for read_file calls containing URL arguments that target private, link-local, or loopback hosts.
Inspect process-level network telemetry from hosts running DesktopCommanderMCP and correlate outbound destinations with expected behavior.
Flag DesktopCommanderMCP instances running version 0.2.37 or earlier that lack the 53699be commit.

Monitoring Recommendations

Forward MCP tool invocation logs to a central SIEM and alert on URL arguments matching internal CIDR ranges.
Place egress filtering between the MCP host and sensitive internal subnets to surface anomalous lateral fetches.
Monitor for unexpected access to cloud metadata services from any workload hosting AI assistant tooling.

How to Mitigate CVE-2026-10690

Immediate Actions Required

Upgrade DesktopCommanderMCP to a version that includes commit 53699bebba9950047bca16ac4dc8f0568f596aaa.
Restrict who can reach the MCP server transport and require authentication on any exposed endpoints.
Apply egress firewall rules that deny outbound traffic from the MCP host to internal management networks and cloud metadata endpoints.

Patch Information

The fix is published in commit 53699bebba9950047bca16ac4dc8f0568f596aaa of the DesktopCommanderMCP repository. The patch introduces validateFetchUrl, which rejects non-HTTP(S) schemes, private and loopback IPv4 ranges, IPv4 link-local addresses, IPv6 loopback and unspecified addresses, and known internal hostnames. See the upstream project repository and issue #410 for status. Note that the patch does not perform DNS resolution, so DNS-rebinding mitigation still requires a network-layer egress control.

Workarounds

Disable the read_file URL-fetching capability if it is not required by your MCP workflows.
Run DesktopCommanderMCP inside a sandbox or container with strict egress policies that block internal CIDRs and 169.254.169.254.
Front the MCP host with an outbound proxy that enforces an allowlist of permitted external destinations.

bash

# Example egress restriction using iptables on the MCP host
iptables -A OUTPUT -m owner --uid-owner mcp -d 127.0.0.0/8     -j REJECT
iptables -A OUTPUT -m owner --uid-owner mcp -d 10.0.0.0/8      -j REJECT
iptables -A OUTPUT -m owner --uid-owner mcp -d 172.16.0.0/12   -j REJECT
iptables -A OUTPUT -m owner --uid-owner mcp -d 192.168.0.0/16  -j REJECT
iptables -A OUTPUT -m owner --uid-owner mcp -d 169.254.0.0/16  -j REJECT