CVE-2026-45609: Spring AI MCP Security SSRF Vulnerability

CVE-2026-45609 Overview

CVE-2026-45609 is a Server-Side Request Forgery (SSRF) vulnerability in the mcp-security framework, which provides Security and Authorization support for the Model Context Protocol (MCP) in Spring AI. Versions prior to 0.1.9 fail to implement the SSRF mitigations required by the MCP security specifications. The framework processes untrusted URLs for OAuth-related discovery and metadata endpoints without validating whether the targets are internal network resources or otherwise malicious. The flaw only affects installations with Dynamic Client Registration (DCR) enabled. The maintainers fixed the issue in version 0.1.9.

Critical Impact
An unauthenticated network attacker can coerce the server into issuing HTTP requests to internal network resources, enabling reconnaissance of internal services and potential exposure of metadata accessible only from the server's network position.

Affected Products

springaicommunity:mcp_security versions prior to 0.1.9
Spring AI deployments integrating MCP authorization flows
Any MCP server installation with Dynamic Client Registration (DCR) enabled

Discovery Timeline

2026-05-29 - CVE CVE-2026-45609 published to NVD
2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-45609

Vulnerability Analysis

The mcp-security framework implements OAuth 2.0 authorization flows for the Model Context Protocol. As part of Dynamic Client Registration (DCR) and authorization server discovery, the framework fetches metadata from URLs supplied by clients or referenced during the registration handshake. The Model Context Protocol security specification mandates that implementations validate these URLs against SSRF risks before issuing outbound requests.

The vulnerable versions skip this validation step. When a request triggers OAuth discovery or metadata retrieval, the framework dispatches HTTP requests to attacker-controlled destinations without checking whether the resolved address points to internal hosts, link-local addresses, or cloud metadata endpoints. This maps to [CWE-918] Server-Side Request Forgery.

Exploitation requires no authentication and no user interaction. The scope is limited to confidentiality and integrity impacts at low severity because the response data returned to the attacker is constrained by how the framework consumes the fetched metadata.

Root Cause

The root cause is the absence of mandatory SSRF mitigations in URL processing during OAuth discovery and metadata retrieval. The framework trusts inbound URLs without enforcing an allowlist, blocking private IP ranges, or validating DNS resolution against internal address space. The MCP specification explicitly requires these checks, but the implementation omitted them prior to 0.1.9.

Attack Vector

A remote attacker interacting with an MCP server that has DCR enabled supplies a crafted URL pointing to an internal resource, such as http://169.254.169.254/latest/meta-data/ on AWS, http://localhost:8080/actuator, or an internal service IP. The framework dereferences the URL during discovery or metadata processing, generating outbound HTTP traffic from the server. Attackers use this to probe internal network topology, fingerprint backend services, or attempt to retrieve cloud instance metadata depending on the deployment environment.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-qjp4-4jvr-xqg3 for the maintainer's technical description.

Detection Methods for CVE-2026-45609

Indicators of Compromise

Outbound HTTP requests from MCP server processes to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or link-local 169.254.169.254.
OAuth discovery or DCR request logs containing URLs whose host portion resolves to internal or loopback addresses.
Unexpected connections from MCP services to cloud instance metadata endpoints not part of normal operation.

Detection Strategies

Inspect application logs for mcp-security DCR registration events that include externally supplied issuer or metadata URLs.
Correlate process telemetry from the Spring AI service against egress network connections to detect outbound traffic that does not match expected OAuth provider endpoints.
Compare deployed mcp-security package versions against the fixed version 0.1.9 across the inventory.

Monitoring Recommendations

Enable verbose logging on OAuth discovery and DCR endpoints to capture client-supplied URLs.
Monitor egress firewall logs for any HTTP traffic from MCP server hosts to RFC1918 ranges or cloud metadata IPs.
Alert on DNS queries from MCP server processes that resolve to internal addresses or unusual external domains.

How to Mitigate CVE-2026-45609

Immediate Actions Required

Upgrade springaicommunity:mcp_security to version 0.1.9 or later in all affected deployments.
If immediate patching is not possible, disable Dynamic Client Registration (DCR) on affected MCP servers to remove the exposed code path.
Audit existing DCR registrations for entries containing internal or suspicious issuer and metadata URLs.

Patch Information

The vulnerability is fixed in mcp-security version 0.1.9. The patch implements the SSRF mitigations required by the MCP security specification, including validation of OAuth discovery and metadata URLs before outbound requests are issued. Refer to the GitHub Security Advisory GHSA-qjp4-4jvr-xqg3 for upgrade details.

Workarounds

Disable Dynamic Client Registration in the MCP server configuration until the upgrade is applied.
Enforce egress filtering that blocks outbound traffic from MCP server hosts to private IP ranges and cloud metadata endpoints such as 169.254.169.254.
Place the MCP server behind an authenticated egress proxy that rejects requests to internal destinations.

bash

# Configuration example: block egress to internal ranges and metadata endpoint
iptables -A OUTPUT -m owner --uid-owner mcp -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner mcp -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner mcp -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner mcp -d 192.168.0.0/16 -j REJECT