CVE-2026-7094: GlutamateMCPServers SSRF Vulnerability

CVE-2026-7094 Overview

A Server-Side Request Forgery (SSRF) vulnerability has been identified in ShadowCloneLabs GlutamateMCPServers affecting versions up to commit e2de73280b01e5d943593dd1aa2c01c5b9112f78. The vulnerability exists in the puppeteer_navigate component, specifically within the file src/puppeteer/index.ts. An attacker can exploit this flaw by manipulating the url argument, allowing them to make arbitrary requests from the server to internal or external resources.

Critical Impact
Remote attackers can exploit the SSRF vulnerability to access internal services, potentially exposing sensitive data, bypassing access controls, or pivoting to attack internal infrastructure. The exploit has been publicly disclosed and may be utilized by threat actors.

Affected Products

ShadowCloneLabs GlutamateMCPServers (up to commit e2de73280b01e5d943593dd1aa2c01c5b9112f78)

Discovery Timeline

2026-04-27 - CVE-2026-7094 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-7094

Vulnerability Analysis

This vulnerability is classified as CWE-918 (Server-Side Request Forgery). The flaw resides in the puppeteer_navigate component within src/puppeteer/index.ts. The application fails to properly validate or sanitize the url argument before processing navigation requests. This allows attackers to craft malicious URLs that direct the server to make requests to arbitrary destinations.

SSRF vulnerabilities in browser automation tools like Puppeteer are particularly dangerous because they inherit the server's network context, potentially allowing access to cloud metadata endpoints (e.g., AWS 169.254.169.254), internal services behind firewalls, or other restricted resources. The GlutamateMCPServers project utilizes a rolling release model, meaning specific version numbers are not disclosed for affected or fixed releases.

Root Cause

The root cause of this vulnerability is improper input validation in the URL handling logic of the puppeteer_navigate function. The code fails to implement sufficient checks to restrict which URLs can be navigated to, allowing user-controlled input to specify arbitrary destinations including internal network addresses, localhost services, and cloud provider metadata endpoints.

Attack Vector

The attack can be performed remotely over the network without requiring authentication or user interaction. An attacker submits a crafted request to the puppeteer_navigate endpoint with a malicious URL parameter. The server then executes a browser navigation to the attacker-specified destination, potentially:

Accessing internal services not exposed to the internet
Retrieving cloud instance metadata containing credentials
Port scanning internal networks
Bypassing IP-based access controls
Exfiltrating data from internal resources

The vulnerability mechanism centers on the lack of URL validation before Puppeteer navigates to the user-supplied address. Technical details and the public disclosure can be found in the GitHub Issue #8 and GitHub Issue #7 documenting the exploit.

Detection Methods for CVE-2026-7094

Indicators of Compromise

Unusual outbound requests from the GlutamateMCPServers application to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
Requests to cloud metadata endpoints such as 169.254.169.254 or metadata.google.internal
Puppeteer navigation requests containing URL parameters pointing to localhost or loopback addresses

Detection Strategies

Implement network monitoring to detect requests from the application server to internal or restricted IP ranges
Review application logs for suspicious URL patterns in puppeteer_navigate requests
Deploy web application firewall (WAF) rules to detect and block SSRF attack patterns in URL parameters
Monitor for connections to common SSRF targets like cloud metadata services and internal service ports

Monitoring Recommendations

Enable verbose logging for all Puppeteer navigation requests including full URL parameters
Set up alerts for requests containing internal IP addresses, localhost references, or cloud metadata URLs
Implement egress filtering to restrict which destinations the application server can reach
Regularly audit network traffic patterns from the GlutamateMCPServers deployment

How to Mitigate CVE-2026-7094

Immediate Actions Required

Review all deployments of GlutamateMCPServers for exposure to untrusted networks
Implement network-level controls to restrict outbound connections from the application server
Consider disabling or restricting access to the puppeteer_navigate functionality until a patch is available
Deploy a WAF or reverse proxy with SSRF protection rules in front of the application

Patch Information

As of the last update on 2026-04-29, the vendor (ShadowCloneLabs) has been notified through an issue report but has not yet responded. The project uses a rolling release model without discrete version numbers. Monitor the GlutamateMCPServers repository for updates addressing this vulnerability.

Workarounds

Implement URL allowlisting to restrict navigation only to trusted domains and hosts
Block requests to private IP ranges, localhost, and cloud metadata endpoints at the application or network level
Run the application in a restricted network environment with limited egress capabilities
Consider using a network proxy that enforces URL restrictions for all outbound HTTP requests

bash

# Example: iptables rules to block common SSRF targets from the application server
# Block access to AWS metadata endpoint
iptables -A OUTPUT -d 169.254.169.254 -j DROP

# Block access to private IP ranges (adjust as needed for legitimate traffic)
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 80 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 443 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -p tcp --dport 80 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -p tcp --dport 443 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -p tcp --dport 80 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -p tcp --dport 443 -j DROP