Server-Side Request Forgery (SSRF) in MCP Gateway - #VU139376
Published: July 26, 2026
Vulnerability details
The vulnerability allows a remote user to cause the gateway to issue server-side requests to internal services and disclose sensitive information.
The vulnerability exists due to server-side request forgery in remote URL handling in clientpool.go GetClient, NewRemoteMCPClient, remote.go, and related catalog/fetch/import paths when processing a server definition with an attacker-controlled remote URL. A remote user can supply untrusted import, catalog, or registry content containing a crafted remote URL to cause the gateway to issue server-side requests to internal services and disclose sensitive information.
Exploitation requires that a server definition with an attacker-chosen remote URL is loaded from untrusted import, catalog, or registry content. The issue can reach internal addresses including link-local instance-metadata endpoints, and the advisory describes the SSRF as blind or partial.