CVE-2026-65056 Overview
CVE-2026-65056 is a server-side request forgery (SSRF) vulnerability in mcp-webresearch version 0.1.7, an npm package that exposes web browsing tools to large language models through the Model Context Protocol (MCP). The visit_page tool validates only the URL protocol and fails to filter loopback, link-local, private, or cloud metadata IP ranges [CWE-918]. Attackers can leverage prompt injection to steer the LLM-controlled URL argument and drive the server's Playwright browser to internal endpoints, including cloud instance metadata services. The returned page content, which may include credentials and internal service data, is then injected into the model context.
Critical Impact
Remote unauthenticated attackers can pivot through the MCP server to reach internal services and cloud metadata endpoints, exfiltrating credentials and sensitive data via the LLM context.
Affected Products
- @mzxrai/mcp-webresearch npm package version 0.1.7
- MCP server deployments exposing the visit_page tool to LLM clients
- Cloud-hosted MCP instances with access to instance metadata services (IMDS)
Discovery Timeline
- 2026-07-21 - CVE-2026-65056 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-65056
Vulnerability Analysis
The mcp-webresearch server exposes a visit_page tool that accepts a URL argument controlled by an LLM. The tool navigates a headless Playwright browser to the supplied URL and returns rendered page content back into the model context. Input validation is limited to a protocol allowlist check, which permits any http or https URL regardless of the resolved host.
Because the server does not resolve and filter destination addresses, requests to 127.0.0.1, 169.254.169.254, RFC1918 ranges, and cloud metadata services are honored. On AWS, GCP, and Azure hosts, this allows retrieval of IAM credentials, instance identity documents, and user-data from the metadata endpoint. The retrieved content flows directly into the model context, where it becomes accessible to any downstream consumer of the conversation.
Root Cause
The root cause is missing host-based validation before performing outbound HTTP navigation [CWE-918]. The visit_page handler treats the URL as opaque after protocol checking and delegates fetching to Playwright without enforcing a network allowlist, DNS pinning, or SSRF-safe HTTP client behavior. No egress restrictions are applied at the application layer.
Attack Vector
Exploitation requires an attacker to influence the LLM's tool call arguments. This is typically achieved through indirect prompt injection: the attacker plants instructions in a web page, document, or search result that the LLM later ingests. When the model invokes visit_page with the attacker-directed URL, such as http://169.254.169.254/latest/meta-data/iam/security-credentials/, the server retrieves the internal response and returns it to the model. The attacker then reads the exfiltrated content from the conversation or a subsequent tool call.
Refer to the VulnCheck Security Advisory and the GitHub Resource Document for technical details.
Detection Methods for CVE-2026-65056
Indicators of Compromise
- Outbound requests from MCP server hosts to 169.254.169.254, metadata.google.internal, or 169.254.169.254/metadata/instance Azure paths.
- Playwright browser navigation logs containing loopback (127.0.0.0/8), link-local (169.254.0.0/16), or RFC1918 destinations.
- LLM conversation transcripts referencing internal hostnames, IAM role names, or cloud metadata JSON structures.
Detection Strategies
- Instrument the MCP server to log every URL passed to visit_page and alert on non-public destinations.
- Correlate LLM tool-call telemetry with egress network flows to identify prompt-injected navigation attempts.
- Inspect model context and response payloads for tokens matching credential formats such as ASIA, AKIA, or JWT patterns.
Monitoring Recommendations
- Enforce IMDSv2 on AWS and monitor PUT /latest/api/token request patterns from MCP hosts.
- Deploy egress firewall logging on hosts running MCP servers and alert on connections to metadata CIDRs.
- Track abnormal spikes in visit_page invocations or unusually long URLs sourced from LLM tool calls.
How to Mitigate CVE-2026-65056
Immediate Actions Required
- Disable the visit_page tool or remove @mzxrai/mcp-webresearch0.1.7 from production MCP deployments until a fixed release is available.
- Rotate any credentials that may have been accessible via cloud metadata services on affected hosts.
- Restrict outbound network access from the MCP server host to an explicit allowlist of external domains.
Patch Information
No vendor-supplied patch is referenced in the NVD entry at the time of publication. Consult the NPM Package Information page for updated releases and the VulnCheck Security Advisory for remediation guidance.
Workarounds
- Enforce IMDSv2 with a hop limit of 1 on cloud instances hosting the MCP server to block containerized or proxied metadata access.
- Run the MCP server in a network namespace or container with egress restricted to public destinations, blocking 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and 169.254.0.0/16.
- Add a pre-navigation guard that resolves the target hostname and rejects any address in private, loopback, link-local, or reserved ranges.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
