Join the Cyber Forum: Threat Intel on May 12, 2026 to learn how AI is reshaping threat defense.Join the Virtual Cyber Forum: Threat IntelRegister Now
Experiencing a Breach?Blog
Get StartedContact Us
SentinelOne
  • Platform
    Platform Overview
    • Singularity Platform
      Welcome to Integrated Enterprise Security
    • AI for Security
      Leading the Way in AI-Powered Security Solutions
    • Securing AI
      Accelerate AI Adoption with Secure AI Tools, Apps, and Agents.
    • How It Works
      The Singularity XDR Difference
    • Singularity Marketplace
      One-Click Integrations to Unlock the Power of XDR
    • Pricing & Packaging
      Comparisons and Guidance at a Glance
    Data & AI
    • Purple AI
      Accelerate SecOps with Generative AI
    • Singularity Hyperautomation
      Easily Automate Security Processes
    • AI-SIEM
      The AI SIEM for the Autonomous SOC
    • AI Data Pipelines
      Security Data Pipeline for AI SIEM and Data Optimization
    • Singularity Data Lake
      AI-Powered, Unified Data Lake
    • Singularity Data Lake for Log Analytics
      Seamlessly Ingest Data from On-Prem, Cloud or Hybrid Environments
    Endpoint Security
    • Singularity Endpoint
      Autonomous Prevention, Detection, and Response
    • Singularity XDR
      Native & Open Protection, Detection, and Response
    • Singularity RemoteOps Forensics
      Orchestrate Forensics at Scale
    • Singularity Threat Intelligence
      Comprehensive Adversary Intelligence
    • Singularity Vulnerability Management
      Application & OS Vulnerability Management
    • Singularity Identity
      Identity Threat Detection and Response
    Cloud Security
    • Singularity Cloud Security
      Block Attacks with an AI-Powered CNAPP
    • Singularity Cloud Native Security
      Secure Cloud and Development Resources
    • Singularity Cloud Workload Security
      Real-Time Cloud Workload Protection Platform
    • Singularity Cloud Data Security
      AI-Powered Threat Detection for Cloud Storage
    • Singularity Cloud Security Posture Management
      Detect and Remediate Cloud Misconfigurations
    Securing AI
    • Prompt Security
      Secure AI Tools Across Your Enterprise
  • Why SentinelOne?
    Why SentinelOne?
    • Why SentinelOne?
      Cybersecurity Built for What’s Next
    • Our Customers
      Trusted by the World’s Leading Enterprises
    • Industry Recognition
      Tested and Proven by the Experts
    • About Us
      The Industry Leader in Autonomous Cybersecurity
    Compare SentinelOne
    • Arctic Wolf
    • Broadcom
    • CrowdStrike
    • Cybereason
    • Microsoft
    • Palo Alto Networks
    • Sophos
    • Splunk
    • Trellix
    • Trend Micro
    • Wiz
    Verticals
    • Energy
    • Federal Government
    • Finance
    • Healthcare
    • Higher Education
    • K-12 Education
    • Manufacturing
    • Retail
    • State and Local Government
  • Services
    Managed Services
    • Managed Services Overview
      Wayfinder Threat Detection & Response
    • Threat Hunting
      World-Class Expertise and Threat Intelligence
    • Managed Detection & Response
      24/7/365 Expert MDR Across Your Entire Environment
    • Incident Readiness & Response
      DFIR, Breach Readiness, & Compromise Assessments
    Support, Deployment, & Health
    • Technical Account Management
      Customer Success with Personalized Service
    • SentinelOne GO
      Guided Onboarding & Deployment Advisory
    • SentinelOne University
      Live and On-Demand Training
    • Services Overview
      Comprehensive Solutions for Seamless Security Operations
    • SentinelOne Community
      Community Login
  • Partners
    Our Network
    • MSSP Partners
      Succeed Faster with SentinelOne
    • Singularity Marketplace
      Extend the Power of S1 Technology
    • Cyber Risk Partners
      Enlist Pro Response and Advisory Teams
    • Technology Alliances
      Integrated, Enterprise-Scale Solutions
    • SentinelOne for AWS
      Hosted in AWS Regions Around the World
    • Channel Partners
      Deliver the Right Solutions, Together
    • SentinelOne for Google Cloud
      Unified, Autonomous Security Giving Defenders the Advantage at Global Scale
    • Partner Locator
      Your Go-to Source for Our Top Partners in Your Region
    Partner Portal→
  • Resources
    Resource Center
    • Case Studies
    • Data Sheets
    • eBooks
    • Reports
    • Videos
    • Webinars
    • Whitepapers
    • Events
    View All Resources→
    Blog
    • Feature Spotlight
    • For CISO/CIO
    • From the Front Lines
    • Identity
    • Cloud
    • macOS
    • SentinelOne Blog
    Blog→
    Tech Resources
    • SentinelLABS
    • Ransomware Anthology
    • Cybersecurity 101
  • About
    About SentinelOne
    • About SentinelOne
      The Industry Leader in Cybersecurity
    • Investor Relations
      Financial Information & Events
    • SentinelLABS
      Threat Research for the Modern Threat Hunter
    • Careers
      The Latest Job Opportunities
    • Press & News
      Company Announcements
    • Cybersecurity Blog
      The Latest Cybersecurity Threats, News, & More
    • FAQ
      Get Answers to Our Most Frequently Asked Questions
    • DataSet
      The Live Data Platform
    • S Foundation
      Securing a Safer Future for All
    • S Ventures
      Investing in the Next Generation of Security, Data and AI
  • Pricing
Get StartedContact Us
CVE Vulnerability Database
Vulnerability Database/CVE-2026-5470

CVE-2026-5470: Google-Research-MCP SSRF Vulnerability

CVE-2026-5470 is a server-side request forgery flaw in Google-Research-MCP affecting the content extractor service. Attackers can exploit URL manipulation remotely. This article covers technical details, impact, and mitigation.

Published: April 10, 2026

CVE-2026-5470 Overview

A Server-Side Request Forgery (SSRF) vulnerability has been identified in mixelpixx Google-Research-MCP, specifically affecting the extractContent function within the src/services/content-extractor.service.ts file of the Model Context Protocol Handler component. This vulnerability allows remote attackers to manipulate the URL argument, enabling them to forge server-side requests to arbitrary internal or external resources.

The exploit has been publicly disclosed, and the vendor was contacted early about this vulnerability but did not respond. This product uses a rolling release model, meaning specific version information for affected or updated releases is not available.

Critical Impact

Remote attackers with low privileges can exploit this SSRF vulnerability to access internal services, exfiltrate sensitive data, or pivot to other systems within the network infrastructure.

Affected Products

  • mixelpixx Google-Research-MCP (commit 1e062d7bd887bfe5f6e582b6cc288bb897b35cf2)
  • mixelpixx Google-Research-MCP (commit ca613b736ab787bc926932f59cddc69457185a83)
  • Model Context Protocol Handler component

Discovery Timeline

  • 2026-04-03 - CVE CVE-2026-5470 published to NVD
  • 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-5470

Vulnerability Analysis

This Server-Side Request Forgery vulnerability exists in the content extraction service of Google-Research-MCP. The extractContent function in content-extractor.service.ts fails to properly validate and sanitize user-supplied URL parameters before making server-side HTTP requests. This allows authenticated attackers to craft malicious URLs that cause the server to make requests to unintended destinations.

SSRF vulnerabilities in Model Context Protocol (MCP) handlers are particularly concerning because these systems often have elevated network access to communicate with various backend services and APIs. An attacker exploiting this flaw could potentially access internal APIs, cloud metadata endpoints, or other sensitive network resources that are not directly accessible from the internet.

Root Cause

The root cause of this vulnerability is improper input validation in the extractContent function (CWE-918: Server-Side Request Forgery). The URL argument is processed without adequate validation checks to ensure it points to legitimate, authorized external resources. The function does not implement allowlisting of permitted domains, blocklisting of internal IP ranges, or proper URL scheme validation before initiating the server-side request.

Attack Vector

The attack can be initiated remotely over the network by an authenticated user with low privileges. The attacker manipulates the URL parameter passed to the content extraction service, substituting a malicious URL targeting internal services, cloud metadata endpoints (such as http://169.254.169.254/), or other restricted network resources.

The vulnerability is exploited through the Model Context Protocol Handler, which processes content extraction requests. By supplying crafted URLs, attackers can:

  • Access internal services and APIs not exposed to the internet
  • Retrieve cloud instance metadata containing credentials
  • Port scan internal network infrastructure
  • Potentially bypass firewall restrictions by using the vulnerable server as a proxy

For detailed technical information about this vulnerability, see the GitHub Issue Discussion and VulDB Vulnerability #355074.

Detection Methods for CVE-2026-5470

Indicators of Compromise

  • Unusual outbound HTTP requests from the MCP server to internal IP ranges (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x)
  • Requests to cloud metadata endpoints such as 169.254.169.254 or metadata.google.internal
  • Abnormal content extraction requests with URLs pointing to localhost or private network addresses
  • Increased latency or errors in content extraction service logs indicating failed internal connections

Detection Strategies

  • Implement network monitoring to detect outbound requests from the MCP server to internal or restricted IP ranges
  • Deploy web application firewall (WAF) rules to inspect and block suspicious URL patterns in content extraction requests
  • Monitor application logs for extractContent function calls with URLs containing internal IP addresses, localhost references, or cloud metadata endpoints
  • Enable SentinelOne Singularity platform for behavioral analysis and network anomaly detection

Monitoring Recommendations

  • Configure alerting for any outbound connections from the content extraction service to non-allowlisted destinations
  • Implement logging of all URL parameters passed to the extractContent function for forensic analysis
  • Set up network segmentation alerts to detect when the MCP server attempts to reach sensitive internal services
  • Monitor for patterns consistent with SSRF exploitation such as rapid sequential requests to incrementing IP addresses

How to Mitigate CVE-2026-5470

Immediate Actions Required

  • Implement strict allowlisting of permitted URL schemes (HTTPS only) and domains in the content extraction service
  • Add blocklist validation to reject URLs containing internal IP ranges, localhost references, and cloud metadata endpoints
  • Apply network-level controls to prevent the MCP server from initiating connections to internal network resources
  • Review access controls to limit which users can invoke the content extraction functionality

Patch Information

No official patch is currently available. The vendor was contacted about this vulnerability but did not respond. Since this product uses a rolling release model, users should monitor the project repository for updates that address this SSRF vulnerability. Additional information may be available through VulDB Submission #781778.

Workarounds

  • Deploy a web application firewall (WAF) in front of the application to filter and block malicious URL patterns
  • Implement a server-side proxy that validates all outbound URLs against an allowlist before permitting requests
  • Use network segmentation to isolate the MCP server and restrict its ability to reach sensitive internal resources
  • Disable or restrict access to the content extraction functionality until a patch is available
bash
# Example network-level mitigation using iptables
# Block outbound requests to internal IP ranges from the application server
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -d 169.254.0.0/16 -j DROP

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

  • Vulnerability Details
  • TypeSSRF

  • Vendor/TechGoogle Research Mcp

  • SeverityMEDIUM

  • CVSS Score5.3

  • EPSS Probability0.04%

  • Known ExploitedNo
  • CVSS Vector
  • CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • Impact Assessment
  • ConfidentialityLow
  • IntegrityNone
  • AvailabilityLow
  • CWE References
  • CWE-918
  • Technical References
  • GitHub Issue Discussion

  • VulDB Submission #781778

  • VulDB Vulnerability #355074

  • VulDB CTI for #355074
  • Latest CVEs
  • CVE-2025-49454: TinySalt Path Traversal Vulnerability

  • CVE-2025-48261: MultiVendorX Information Disclosure Flaw

  • CVE-2025-32119: CardGate WooCommerce SQL Injection Flaw

  • CVE-2025-26879: s2Member Plugin Reflected XSS Vulnerability
Default Legacy - Prefooter | Experience the World’s Most Advanced Cybersecurity Platform

Experience the World’s Most Advanced Cybersecurity Platform

See how our intelligent, autonomous cybersecurity platform can protect your organization now and into the future.

Try SentinelOne
  • Get Started
  • Get a Demo
  • Product Tour
  • Why SentinelOne
  • Pricing & Packaging
  • FAQ
  • Contact
  • Contact Us
  • Customer Support
  • SentinelOne Status
  • Language
  • Platform
  • Singularity Platform
  • Singularity Endpoint
  • Singularity Cloud
  • Singularity AI-SIEM
  • Singularity Identity
  • Singularity Marketplace
  • Purple AI
  • Services
  • Wayfinder TDR
  • SentinelOne GO
  • Technical Account Management
  • Support Services
  • Verticals
  • Energy
  • Federal Government
  • Finance
  • Healthcare
  • Higher Education
  • K-12 Education
  • Manufacturing
  • Retail
  • State and Local Government
  • Cybersecurity for SMB
  • Resources
  • Blog
  • Labs
  • Case Studies
  • Videos
  • Product Tours
  • Events
  • Cybersecurity 101
  • eBooks
  • Webinars
  • Whitepapers
  • Press
  • News
  • Ransomware Anthology
  • Company
  • About Us
  • Our Customers
  • Careers
  • Partners
  • Legal & Compliance
  • Security & Compliance
  • Investor Relations
  • S Foundation
  • S Ventures

©2026 SentinelOne, All Rights Reserved.

Privacy Notice Terms of Use

English