CVE-2026-7150: Auto-Favicon SSRF Vulnerability

CVE-2026-7150 Overview

A Server-Side Request Forgery (SSRF) vulnerability has been identified in the dh1011 auto-favicon MCP tool. This vulnerability affects the generate_favicon_from_url function within the src/auto_favicon/server.py file. The flaw allows remote attackers to manipulate the image_url argument to force the server to make arbitrary HTTP requests to internal or external resources, potentially exposing sensitive information or enabling further attacks on internal infrastructure.

Critical Impact

Remote attackers can exploit the SSRF vulnerability to access internal services, bypass network security controls, or conduct reconnaissance on internal network infrastructure through the compromised server.

Affected Products

• dh1011 auto-favicon (up to commit f189116a9259950c2393f114dbcb94dde0ad864b)
• auto-favicon-mcp MCP Tool component

Discovery Timeline

• 2026-04-27 - CVE-2026-7150 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-7150

Vulnerability Analysis

This SSRF vulnerability exists in the auto-favicon MCP (Model Context Protocol) tool, which is designed to automatically generate favicons from URLs. The vulnerable function generate_favicon_from_url in the server component does not properly validate or sanitize the image_url parameter before making HTTP requests.

When an attacker supplies a malicious URL pointing to internal resources (such as cloud metadata endpoints, internal APIs, or localhost services), the server processes the request on behalf of the attacker. This allows the attacker to effectively bypass network security controls and access resources that would otherwise be unreachable from external networks.

The exploit has been publicly disclosed, increasing the risk of exploitation. The project maintainers were notified through an issue report but had not responded at the time of disclosure.

Root Cause

The root cause of this vulnerability is inadequate input validation on the image_url parameter within the generate_favicon_from_url function. The application fails to implement proper URL validation, scheme whitelisting, or network-level restrictions to prevent requests to internal or sensitive endpoints. This allows arbitrary URLs including internal IP addresses, localhost references, and cloud metadata endpoints to be processed by the server.

Attack Vector

The attack can be performed remotely over the network by any authenticated user. An attacker exploits this vulnerability by submitting a crafted image_url parameter that points to internal resources or sensitive endpoints. The server then makes an HTTP request to the attacker-specified URL, returning the response content or metadata to the attacker.

Common attack scenarios include:

• Accessing cloud provider metadata services (e.g., http://169.254.169.254/)
• Scanning internal network services
• Accessing internal APIs or administrative interfaces
• Exfiltrating data from services only accessible within the internal network

For technical details on the exploitation method, see the GitHub Issue Discussion.

Detection Methods for CVE-2026-7150

Indicators of Compromise

• Unusual outbound HTTP requests from the auto-favicon server to internal IP ranges (10.x.x.x, 172.16.x.x-172.31.x.x, 192.168.x.x)
• Requests to cloud metadata endpoints such as 169.254.169.254 or fd00:ec2::254
• Access logs showing requests with localhost or loopback addresses (127.0.0.1, ::1)
• Unexpected responses containing internal service data or credentials

Detection Strategies

• Monitor network traffic from the auto-favicon server for connections to internal IP ranges or cloud metadata services
• Implement application-layer logging to capture all URLs processed by the generate_favicon_from_url function
• Configure web application firewall (WAF) rules to detect SSRF patterns in request parameters
• Deploy intrusion detection system (IDS) rules to identify SSRF exploitation attempts

Monitoring Recommendations

• Enable verbose logging for all favicon generation requests, capturing the full image_url parameter
• Set up alerts for any outbound connections from the server to RFC 1918 private address ranges
• Monitor for unusual DNS queries from the auto-favicon server that may indicate SSRF probing
• Review access logs regularly for patterns indicative of reconnaissance activity

How to Mitigate CVE-2026-7150

Immediate Actions Required

• Disable or restrict access to the auto-favicon MCP tool until a patch is available
• Implement network-level controls to prevent the server from accessing internal resources
• Add URL validation at the application level to whitelist only trusted external domains
• Review access controls to limit who can invoke the generate_favicon_from_url function

Patch Information

As of the last update, the auto-favicon project uses a rolling release model and no official patch has been released. The project maintainers were notified via an issue report but have not yet responded. Organizations should monitor the project repository for updates and apply patches as soon as they become available.

For additional vulnerability details, refer to the VulDB Vulnerability Record.

Workarounds

• Implement a URL allowlist that only permits requests to known, trusted external domains
• Deploy network segmentation to isolate the auto-favicon server from sensitive internal resources
• Configure egress filtering on the server to block requests to internal IP ranges and cloud metadata endpoints
• Consider using a proxy service that validates and sanitizes URLs before forwarding requests

# Example: iptables rules to block outbound connections to internal ranges
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -d 169.254.169.254 -j DROP