Description

A flaw has been found in MissionSquad mcp-api up to 1.11.9. The affected element is an unknown function of the file src/services/dcrClients.ts. Executing a manipulation can lead to server-side request forgery. The attack may be performed from remote. Upgrading to version 1.11.10 is sufficient to fix this issue. This patch is called f068ab4ad6f0907ac7001b995588c2673f11a755. You should upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-06T14:16:36.043Z",
  "pubdate": "2026-08-06T14:16:36.043Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability has been identified in the MissionSquad mcp-api product affecting versions up to 1.11.9. This security flaw resides in an unknown function within the src/services/dcrClients.ts file.\nThe vulnerability allows remote threat actors to manipulate input parameters, tricking the vulnerable application into initiating unauthorized outbound HTTP requests to arbitrary internal or external destinations. Such exploitation can lead to internal network reconnaissance, access to restricted metadata endpoints, or secondary attacks against internal services that are otherwise shielded from the public internet.\nThe attack can be executed remotely over the network without requiring prior authentication or specific privileges, elevating the overall risk to the infrastructure hosting the affected application.\nTo remediate this security risk, administrators and developers must upgrade the MissionSquad mcp-api component to version 1.11.10 or apply the official patch identified by the commit hash f068ab4ad6f0907ac7001b995588c2673f11a755.",
  "technicalDetails": "The vulnerability is classified as Server-Side Request Forgery (SSRF), stemming from inadequate validation and sanitization of user-supplied input utilized within network request generation logic.\nThe affected component is located in the file src/services/dcrClients.ts, where an unknown function processes parameters that directly dictate the Uniform Resource Identifier (URI) or URL for outbound server-to-server communications.\nThe root cause involves the application trusting and processing unvalidated input to construct outgoing HTTP or network requests. Because the server itself initiates the connection, it can be coerced into querying resources on the local loopback interface (127.0.0.1), internal corporate local area networks (LANs), or cloud provider instance metadata services (IMDS).\nDuring a typical attack flow, a remote unauthenticated attacker transmits a crafted payload to the exposed service endpoints of the MissionSquad mcp-api. The input reaches the vulnerable function inside src/services/dcrClients.ts without proper normalization or allow-listing. The application then resolves and dispatches a request to the attacker-controlled or attacker-specified target URL.\nNetwork exposure for this vulnerability is remote, meaning any attacker with network connectivity to the API can attempt exploitation. No authentication or elevated privilege requirements are specified for triggering the flaw.\nDepending on the network architecture and internal service posture, successful exploitation can result in the retrieval of sensitive internal data, bypass of perimeter firewalls, interaction with internal APIs, or potential Remote Code Execution (RCE) if internal services suffer from weak authentication."
}