CVE-2026-81421 Overview
CVE-2026-81421 is a server-side request forgery (SSRF) vulnerability in ddfourtwo sentry-selfhosted-mcp version 0.4.0. The flaw resides in an unknown function of the raw_sentry_api component. Attackers can manipulate the endpoint argument to coerce the server into issuing HTTP requests to arbitrary destinations. The vulnerability is exploitable remotely without authentication or user interaction, and an exploit has been publicly released. The maintainers were notified through a GitHub issue but have not responded, meaning no official patch is currently available.
Critical Impact
Unauthenticated remote attackers can abuse the raw_sentry_api endpoint parameter to pivot requests to internal services, cloud metadata endpoints, or arbitrary external hosts, exposing confidentiality, integrity, and availability of the host environment.
Affected Products
- ddfourtwo sentry-selfhosted-mcp 0.4.0
- Model Context Protocol (MCP) server for self-hosted Sentry
- Deployments exposing the raw_sentry_api component to untrusted callers
Discovery Timeline
- 2026-08-27 - CVE-2026-81421 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-81421
Vulnerability Analysis
The vulnerability is classified under CWE-918: Server-Side Request Forgery. The raw_sentry_api component accepts an endpoint argument that is used to construct an outbound HTTP request without adequate validation of the target URL. Because MCP servers commonly run within trusted network segments and expose tool interfaces to AI agents or other clients, an attacker-controlled endpoint value can be redirected to internal-only resources.
Exploitation lets an attacker reach services otherwise inaccessible from the public internet, including cloud instance metadata services, internal admin panels, and adjacent microservices. The sentry-selfhosted-mcp project is designed to bridge Sentry with MCP clients, so any credentials or tokens held by the process may be reflected in forged requests.
Root Cause
The root cause is missing validation and allowlisting on the endpoint parameter passed to raw_sentry_api. The function trusts caller-supplied input to build the outbound request URL rather than restricting requests to a fixed set of Sentry API paths on a trusted host.
Attack Vector
The attack is network-based and requires no privileges or user interaction. An attacker sends a crafted request to the MCP server invoking raw_sentry_api with an endpoint value pointing at an internal or attacker-controlled URL. Refer to the GitHub issue tracking this flaw and the VulDB entry for CVE-2026-81421 for reproduction details.
// No verified proof-of-concept code is published in NVD.
// See the referenced GitHub issue and VulDB entry for technical details.
Detection Methods for CVE-2026-81421
Indicators of Compromise
- Outbound HTTP requests from the sentry-selfhosted-mcp process to non-Sentry hosts, private RFC1918 ranges, or cloud metadata IPs such as 169.254.169.254.
- MCP tool invocations of raw_sentry_api where the endpoint argument contains a full URL, scheme prefix, @ character, or unusual host component.
- Unexpected 4xx/5xx responses logged by the MCP server after malformed endpoint values.
Detection Strategies
- Inspect application and proxy logs for raw_sentry_api calls whose endpoint parameter deviates from the expected Sentry API path allowlist.
- Correlate MCP server egress traffic against a baseline of legitimate Sentry destinations to flag anomalous fan-out.
- Alert on process-level network connections initiated by the MCP runtime to internal management interfaces or metadata services.
Monitoring Recommendations
- Enable verbose request logging on the MCP server, capturing the full endpoint argument for each raw_sentry_api invocation.
- Route MCP egress through an authenticated forward proxy that logs destination host, path, and response size.
- Monitor for spikes in outbound request volume from containers or hosts running sentry-selfhosted-mcp.
How to Mitigate CVE-2026-81421
Immediate Actions Required
- Restrict network access to the MCP server so only trusted clients can invoke raw_sentry_api.
- Block outbound traffic from the MCP host to internal management ranges and cloud metadata endpoints at the network layer.
- Remove or disable the raw_sentry_api tool exposure until an upstream fix is available.
Patch Information
No vendor patch is available at publication time. The project was informed via GitHub Issue #2 but has not responded. Monitor the ddfourtwo/sentry-selfhosted-mcp repository for future releases addressing CVE-2026-81421.
Workarounds
- Deploy a reverse proxy in front of the MCP server that validates and rewrites the endpoint parameter against a strict allowlist of Sentry API paths.
- Run the MCP process in a network namespace or container with egress limited to the Sentry API host only.
- Drop requests where the endpoint argument contains a scheme (http://, https://), @, or references non-Sentry hostnames.
# Example egress restriction using iptables to allow only the Sentry API host
SENTRY_HOST_IP="<your-sentry-api-ip>"
iptables -A OUTPUT -m owner --uid-owner mcp -d "$SENTRY_HOST_IP" -p tcp --dport 443 -j ACCEPT
iptables -A OUTPUT -m owner --uid-owner mcp -d 169.254.169.254 -j DROP
iptables -A OUTPUT -m owner --uid-owner mcp -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
