CVE-2026-19374 Overview
CVE-2026-19374 is a server-side request forgery (SSRF) vulnerability affecting the adafap api-mcp project up to commit 92b9a5d04acfec165c7d4ef852496593aa87be06. The flaw resides in the customAxios function within app/api/proxy/route.ts, part of the Proxy API Endpoint component. Attackers can manipulate the url argument to coerce the server into issuing arbitrary outbound HTTP requests. The attack is exploitable remotely without authentication or user interaction. The project follows a rolling release model, so specific fixed versions are not available. The maintainers were notified through a public issue but have not yet responded.
Critical Impact
Unauthenticated remote attackers can abuse the proxy endpoint to reach internal network resources, cloud metadata services, and other systems reachable from the vulnerable host.
Affected Products
- adafap api-mcp up to commit 92b9a5d04acfec165c7d4ef852496593aa87be06
- Proxy API Endpoint component (app/api/proxy/route.ts)
- customAxios function within the proxy route handler
Discovery Timeline
- 2026-08-09 - CVE-2026-19374 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-19374
Vulnerability Analysis
The vulnerability is classified as server-side request forgery [CWE-918]. The customAxios function in app/api/proxy/route.ts accepts a client-supplied url parameter and forwards HTTP requests to that destination without validating the target host. Because the endpoint acts as a generic proxy, attackers can direct the server to issue requests to arbitrary URLs, including hosts on the internal network that the server can reach but the attacker cannot.
SSRF against a proxy endpoint typically enables reconnaissance of internal services, interaction with unauthenticated internal APIs, and retrieval of cloud instance metadata such as AWS IMDS at 169.254.169.254. The response body from the proxied request is generally returned to the attacker, extending the impact from blind SSRF to a full read primitive against reachable services.
Root Cause
The root cause is missing validation and allow-listing of the destination URL passed to the customAxios HTTP client. The function trusts caller-supplied input for the request target, and does not restrict schemes, resolve and check destination IP addresses against private ranges, or block loopback and link-local addresses.
Attack Vector
An unauthenticated remote attacker sends a request to the Proxy API Endpoint with a crafted url value pointing to an internal or otherwise sensitive host. The server executes the request via customAxios and returns the response to the attacker. No credentials or user interaction are required. Verified proof-of-concept exploit code is not publicly available at this time. See the VulDB entry for CVE-2026-19374 and the GitHub issue tracker for further technical context.
Detection Methods for CVE-2026-19374
Indicators of Compromise
- Requests to /api/proxy containing url parameters that resolve to private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), or link-local (169.254.0.0/16) addresses.
- Outbound connections from the api-mcp host to cloud metadata endpoints such as 169.254.169.254 or metadata.google.internal.
- Unusual volumes of proxy requests from a single source targeting varied hosts and ports, indicative of internal network scanning.
Detection Strategies
- Deploy application-layer logging that captures the full url argument submitted to the proxy route and flags non-allowlisted hosts.
- Implement egress monitoring on the server hosting api-mcp to identify requests destined for internal ranges or metadata services.
- Use web application firewall rules that inspect request bodies to the proxy endpoint for private IP literals, DNS names resolving to internal ranges, and non-HTTP schemes.
Monitoring Recommendations
- Correlate proxy request logs with DNS resolution logs to detect DNS rebinding attempts against the url parameter.
- Alert on any successful response from the proxy endpoint where the destination host falls outside a defined allow-list of legitimate upstream APIs.
- Track authentication failures and anomalous 4xx/5xx patterns on internal services that suddenly begin receiving traffic sourced from the api-mcp server.
How to Mitigate CVE-2026-19374
Immediate Actions Required
- Restrict network access to the api-mcp Proxy API Endpoint so it is not exposed to untrusted networks until a fix is available.
- Enforce egress firewall rules on the host running api-mcp that block outbound traffic to internal ranges, loopback, and cloud metadata IPs.
- Add an application-layer allow-list of permitted upstream hosts within the customAxios call path if operating a self-managed fork.
Patch Information
No vendor patch is available. The project uses a rolling release strategy, and according to the CVE record the maintainers have not responded to the disclosure filed as GitHub Issue #4. Monitor the adafap/api-mcp repository for commits addressing input validation in app/api/proxy/route.ts.
Workarounds
- Disable the /api/proxy route entirely if the proxy functionality is not required by your deployment.
- Wrap customAxios with a validator that parses the url argument, resolves the hostname, and rejects private, loopback, link-local, and multicast addresses.
- Restrict allowed URL schemes to https: and reject file:, gopher:, ftp:, and other non-HTTP schemes that expand SSRF impact.
- Require authentication and rate limiting on the proxy endpoint to reduce anonymous abuse and reconnaissance.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
