CVE-2026-94051: cowork_bench SSRF Vulnerability

CVE-2026-94051 Overview

CVE-2026-94051 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in the cowork_bench project maintained by GitHub user 0717376. The flaw resides in the ControlFlowNode function within local_servers/pdf-tools-mcp/pdf_tools_mcp/server.py, part of the pdf-tools-mcp component. An authenticated remote attacker can manipulate the pdf_file_path argument to coerce the server into issuing arbitrary outbound requests. The project uses a rolling release model, so no fixed version identifiers are available. A public exploit has been disclosed, and the maintainer has not yet responded to the issue report.

Critical Impact
Remote attackers with low privileges can abuse the pdf_file_path parameter to force the server to request attacker-controlled URLs, enabling internal network reconnaissance and access to metadata services.

Affected Products

0717376/cowork_bench repository up to commit d943e75bc0fc8e3b27141979300cd8cbcd1e890d
pdf-tools-mcp component (local_servers/pdf-tools-mcp/pdf_tools_mcp/server.py)
Rolling release distributions – no fixed version identifiers published

Discovery Timeline

2026-09-20 - CVE-2026-94051 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-94051

Vulnerability Analysis

The vulnerability affects the ControlFlowNode function in the pdf-tools-mcp Model Context Protocol (MCP) server. The function accepts a pdf_file_path argument that is intended to reference a PDF document but performs insufficient validation on the input. When a URL is supplied instead of a local file path, the server dereferences the URL and initiates an outbound request from the server's network context.

The flaw is classified as Server-Side Request Forgery (SSRF) under [CWE-918]. Attackers can direct the server to internal hosts that are not reachable from the public internet. Common SSRF impact scenarios include probing internal services, retrieving cloud provider instance metadata, and bypassing network-layer access controls. The EPSS model currently estimates a 0.366% probability of exploitation.

Root Cause

The root cause is missing validation and allow-listing on the pdf_file_path parameter inside ControlFlowNode. The function does not distinguish between local filesystem paths and remote URL schemes such as http://, https://, file://, or gopher://. Any authenticated caller of the MCP tool can therefore supply a URL that the server will fetch on their behalf.

Attack Vector

Exploitation requires network access to the pdf-tools-mcp server and low-privilege authentication. The attacker submits a crafted tool invocation containing a URL in the pdf_file_path field. The server processes the request and issues an outbound HTTP request to the specified destination, returning content or side-effects observable to the attacker. Public exploit details are available on the Public Exploit Issue and the VulDB CVE-2026-94051 entry.

No verified proof-of-concept code is republished here. Refer to the linked references for reproduction details.

Detection Methods for CVE-2026-94051

Indicators of Compromise

Outbound HTTP or HTTPS requests originating from the pdf-tools-mcp process to internal RFC1918 ranges or cloud metadata endpoints such as 169.254.169.254.
MCP tool invocations where the pdf_file_path argument begins with a URL scheme (http://, https://, file://, gopher://, ftp://) rather than a filesystem path.
Unexpected DNS resolutions from the cowork_bench host targeting attacker-controlled domains.

Detection Strategies

Instrument the ControlFlowNode function with request logging that captures the raw pdf_file_path value for every invocation.
Deploy egress network monitoring that flags any outbound connection from the MCP server to non-approved destinations.
Alert on parameter values that match URL patterns using regular expressions in application-layer logs or a Web Application Firewall (WAF).

Monitoring Recommendations

Forward application logs and network telemetry from the pdf-tools-mcp host to a centralized SIEM for correlation.
Baseline the normal outbound destinations of the MCP server and alert on deviations.
Monitor cloud instance metadata service (IMDS) access patterns and require IMDSv2 where the workload runs in AWS.

How to Mitigate CVE-2026-94051

Immediate Actions Required

Restrict network egress from any host running pdf-tools-mcp using host firewall rules or cloud security groups, blocking access to internal ranges and metadata endpoints.
Disable or gate the pdf-tools-mcp component until validated input handling is in place for pdf_file_path.
Rotate credentials or tokens that may have been exposed through prior SSRF access to metadata services.

Patch Information

No vendor patch is available. The project has been notified through the GitHub Issue Tracker but has not responded. Because the project follows a rolling release model, downstream operators must apply local mitigations or fork the repository to introduce input validation until an upstream fix is published. Track the GitHub Project Repository for updates.

Workarounds

Wrap the pdf_file_path argument with a validator that rejects any value containing a URL scheme and resolves the path against an allow-listed base directory.
Run the MCP server in a network namespace or container with no egress access to internal subnets, cloud metadata endpoints, or the public internet beyond required destinations.
Require IMDSv2 on AWS workloads and equivalent hardening on Azure and GCP metadata services to blunt credential theft via SSRF.

bash

# Example egress restriction using iptables to block cloud metadata access
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 80 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -p tcp --dport 80 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -p tcp --dport 80 -j DROP