CVE-2026-19375 Overview
CVE-2026-19375 is a Server-Side Request Forgery (SSRF) vulnerability in dmitriiweb article-scraper-mcp version 1.0.0. The flaw resides in the fetch_article function of news_scraper_mcp/server.py, where attacker-controlled input to the url argument is passed to the outbound HTTP client without validation. An authenticated remote attacker can coerce the server to issue requests to arbitrary destinations, including internal-only services and cloud metadata endpoints. Public exploit details are available, and the project maintainer has not yet responded to the disclosure issue filed on GitHub. The weakness is classified under CWE-918: Server-Side Request Forgery.
Critical Impact
Remote attackers can pivot through the MCP server to reach internal network resources, cloud metadata services, and non-routable endpoints that would otherwise be inaccessible.
Affected Products
- dmitriiweb/article-scraper-mcp version 1.0.0
- Component: news_scraper_mcp/server.py — fetch_article function
- Any MCP client integration exposing this server to untrusted input
Discovery Timeline
- 2026-08-10 - CVE-2026-19375 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-19375
Vulnerability Analysis
The article-scraper-mcp project is a Model Context Protocol (MCP) server that fetches and parses remote articles on behalf of a client. The fetch_article tool accepts a url parameter and issues an HTTP GET to that destination to retrieve article content. The implementation performs no scheme allow-listing, no host validation, and no filtering of loopback or private IP ranges before dispatching the request.
Because MCP servers frequently run alongside sensitive local services or inside cloud workloads, a client that supplies a crafted URL can direct the server to internal HTTP endpoints. The response body is returned to the caller, enabling information disclosure in addition to blind request forgery.
Root Cause
The root cause is missing input validation on the url argument prior to the outbound network call. User-controlled input is treated as a trusted destination, violating the guidance in CWE-918. No allow-list of hostnames, no denial of private address ranges, and no scheme restriction is applied.
Attack Vector
A remote attacker with the ability to invoke the fetch_article tool submits a URL pointing to an internal resource. Typical targets include http://127.0.0.1, http://169.254.169.254/latest/meta-data/ on AWS, http://metadata.google.internal/ on GCP, or intranet management interfaces. The MCP server issues the request from its own network position and returns response data to the caller. Refer to the VulDB entry for CVE-2026-19375 and the public GitHub issue for further technical detail. No verified proof-of-concept code is included here.
Detection Methods for CVE-2026-19375
Indicators of Compromise
- Outbound HTTP requests from the MCP server process to RFC1918 addresses, loopback interfaces, or link-local ranges such as 169.254.0.0/16.
- Requests from the scraper host to cloud metadata endpoints including 169.254.169.254 and metadata.google.internal.
- Anomalous url parameter values in MCP tool invocation logs containing internal hostnames, non-http(s) schemes, or IP literals.
Detection Strategies
- Log every invocation of the fetch_article tool and alert when the resolved destination falls outside expected public article domains.
- Correlate MCP server egress traffic with a baseline of known-good article sources; flag deviations for review.
- Inspect application logs for the news_scraper_mcp/server.py module handling unusual URL schemes such as file://, gopher://, or dict://.
Monitoring Recommendations
- Forward MCP server and host network telemetry to a centralized analytics platform for correlation across tool calls and egress flows.
- Enable alerts on any process-level connections to cloud instance metadata service (IMDS) addresses from workloads that do not require IMDS access.
- Track the upstream GitHub repository for a fix commit and pin dependency versions until a patched release is available.
How to Mitigate CVE-2026-19375
Immediate Actions Required
- Restrict access to the article-scraper-mcp server so only trusted MCP clients can invoke the fetch_article tool.
- Deploy an egress filter that blocks the scraper host from reaching RFC1918, loopback, and cloud metadata addresses.
- Where cloud-hosted, enforce IMDSv2 with hop-limit 1 on AWS or equivalent metadata protections on other providers.
Patch Information
At the time of publication, no vendor patch is available. The GitHub issue tracking this vulnerability remains open without a maintainer response. Users should monitor the project repository for a fixed release and validate any fork or unofficial patch against the VulDB advisory.
Workarounds
- Wrap fetch_article calls in a proxy that validates the url argument against an allow-list of article-publishing domains and rejects IP literals.
- Resolve the destination hostname prior to the fetch and reject any address in private, loopback, link-local, or multicast ranges.
- Restrict outbound connections from the MCP server to tcp/80 and tcp/443 only, and terminate egress through a filtering proxy that enforces domain policy.
# Example egress restriction using iptables on the MCP host
# Deny access to loopback, private, and IMDS addresses from the scraper user
iptables -A OUTPUT -m owner --uid-owner mcp -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner mcp -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner mcp -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner mcp -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner mcp -d 169.254.0.0/16 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
