CVE-2026-5470: Google-Research-MCP SSRF Vulnerability

CVE-2026-5470 Overview

A Server-Side Request Forgery (SSRF) vulnerability has been identified in mixelpixx Google-Research-MCP, specifically affecting the extractContent function within the src/services/content-extractor.service.ts file of the Model Context Protocol Handler component. This vulnerability allows remote attackers to manipulate the URL argument, enabling them to forge server-side requests to arbitrary internal or external resources.

The exploit has been publicly disclosed, and the vendor was contacted early about this vulnerability but did not respond. This product uses a rolling release model, meaning specific version information for affected or updated releases is not available.

Critical Impact

Remote attackers with low privileges can exploit this SSRF vulnerability to access internal services, exfiltrate sensitive data, or pivot to other systems within the network infrastructure.

Affected Products

• mixelpixx Google-Research-MCP (commit 1e062d7bd887bfe5f6e582b6cc288bb897b35cf2)
• mixelpixx Google-Research-MCP (commit ca613b736ab787bc926932f59cddc69457185a83)
• Model Context Protocol Handler component

Discovery Timeline

• 2026-04-03 - CVE CVE-2026-5470 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-5470

Vulnerability Analysis

This Server-Side Request Forgery vulnerability exists in the content extraction service of Google-Research-MCP. The extractContent function in content-extractor.service.ts fails to properly validate and sanitize user-supplied URL parameters before making server-side HTTP requests. This allows authenticated attackers to craft malicious URLs that cause the server to make requests to unintended destinations.

SSRF vulnerabilities in Model Context Protocol (MCP) handlers are particularly concerning because these systems often have elevated network access to communicate with various backend services and APIs. An attacker exploiting this flaw could potentially access internal APIs, cloud metadata endpoints, or other sensitive network resources that are not directly accessible from the internet.

Root Cause

The root cause of this vulnerability is improper input validation in the extractContent function (CWE-918: Server-Side Request Forgery). The URL argument is processed without adequate validation checks to ensure it points to legitimate, authorized external resources. The function does not implement allowlisting of permitted domains, blocklisting of internal IP ranges, or proper URL scheme validation before initiating the server-side request.

Attack Vector

The attack can be initiated remotely over the network by an authenticated user with low privileges. The attacker manipulates the URL parameter passed to the content extraction service, substituting a malicious URL targeting internal services, cloud metadata endpoints (such as http://169.254.169.254/), or other restricted network resources.

The vulnerability is exploited through the Model Context Protocol Handler, which processes content extraction requests. By supplying crafted URLs, attackers can:

• Access internal services and APIs not exposed to the internet
• Retrieve cloud instance metadata containing credentials
• Port scan internal network infrastructure
• Potentially bypass firewall restrictions by using the vulnerable server as a proxy

For detailed technical information about this vulnerability, see the GitHub Issue Discussion and VulDB Vulnerability #355074.

Detection Methods for CVE-2026-5470

Indicators of Compromise

• Unusual outbound HTTP requests from the MCP server to internal IP ranges (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x)
• Requests to cloud metadata endpoints such as 169.254.169.254 or metadata.google.internal
• Abnormal content extraction requests with URLs pointing to localhost or private network addresses
• Increased latency or errors in content extraction service logs indicating failed internal connections

Detection Strategies

• Implement network monitoring to detect outbound requests from the MCP server to internal or restricted IP ranges
• Deploy web application firewall (WAF) rules to inspect and block suspicious URL patterns in content extraction requests
• Monitor application logs for extractContent function calls with URLs containing internal IP addresses, localhost references, or cloud metadata endpoints
• Enable SentinelOne Singularity platform for behavioral analysis and network anomaly detection

Monitoring Recommendations

• Configure alerting for any outbound connections from the content extraction service to non-allowlisted destinations
• Implement logging of all URL parameters passed to the extractContent function for forensic analysis
• Set up network segmentation alerts to detect when the MCP server attempts to reach sensitive internal services
• Monitor for patterns consistent with SSRF exploitation such as rapid sequential requests to incrementing IP addresses

How to Mitigate CVE-2026-5470

Immediate Actions Required

• Implement strict allowlisting of permitted URL schemes (HTTPS only) and domains in the content extraction service
• Add blocklist validation to reject URLs containing internal IP ranges, localhost references, and cloud metadata endpoints
• Apply network-level controls to prevent the MCP server from initiating connections to internal network resources
• Review access controls to limit which users can invoke the content extraction functionality

Patch Information

No official patch is currently available. The vendor was contacted about this vulnerability but did not respond. Since this product uses a rolling release model, users should monitor the project repository for updates that address this SSRF vulnerability. Additional information may be available through VulDB Submission #781778.

Workarounds

• Deploy a web application firewall (WAF) in front of the application to filter and block malicious URL patterns
• Implement a server-side proxy that validates all outbound URLs against an allowlist before permitting requests
• Use network segmentation to isolate the MCP server and restrict its ability to reach sensitive internal resources
• Disable or restrict access to the content extraction functionality until a patch is available

# Example network-level mitigation using iptables
# Block outbound requests to internal IP ranges from the application server
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -d 169.254.0.0/16 -j DROP