Description

A vulnerability was detected in Model Context Protocol mcp-rdf-explorer 1.0.0. Affected is the function explore_url of the file src/mcp-rdf-explorer/server.py of the component MCP Server. Performing a manipulation of the argument url results in server-side request forgery. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-13T23:17:14.440Z",
  "pubdate": "2026-08-13T23:17:14.440Z",
  "executiveSummary": "A Server-Side Request Forgery vulnerability has been identified in the Model Context Protocol mcp-rdf-explorer component, specifically within version 1.0.0. The vulnerability exists in the explore_url function located within the src/mcp-rdf-explorer/server.py file. An unauthenticated remote attacker can exploit this flaw by supplying a manipulated url argument, which forces the underlying server to initiate arbitrary HTTP requests on behalf of the attacker. This exposes internal network resources, local services, and metadata endpoints that are typically inaccessible from the public internet. The risk implications are severe, potentially allowing unauthorized data exfiltration, internal port scanning, and service interaction within the victim network perimeter. Exploitation can be initiated remotely without requiring prior authentication or specialized privileges, posing an immediate risk to deployments running the affected software version. Public exploits for this vulnerability are currently available, and the vendor has failed to respond to early disclosure notifications, leaving implementations without an official vendor-supplied patch.",
  "technicalDetails": "The vulnerability stems from improper input validation and sanitization of the url parameter processed by the explore_url function within the src/mcp-rdf-explorer/server.py file of the MCP Server component. When a client interacts with the MCP Server, the application accepts user-supplied URL strings intended for Resource Description Framework exploration and dereferencing. Due to the lack of strict schema validation, destination whitelisting, or network-level restrictions, the application directly passes the attacker-controlled URL into its underlying HTTP request execution routines.\nThe attack flow begins when a remote attacker crafts a malicious request containing a targeted URL payload. This payload can target internal network addresses (such as RFC 1918 space), cloud metadata service endpoints (e.g., 169.254.169.254), or loopback addresses (127.0.0.1) that are hosted locally on the server infrastructure. Upon receiving the payload, the explore_url function initiates an outbound connection to the specified URI. The server then retrieves the response from the internal resource and potentially reflects or processes the data, allowing the attacker to deduce internal network topology, read sensitive configuration data, or interact with backend management interfaces.\nThe affected software version is strictly 1.0.0. The vulnerable component operates with network exposure, as it accepts remote requests over the network interface without enforcing authentication or privilege barriers. Because the exploit vector is accessible remotely and requires no authentication credentials, any external entity capable of reaching the MCP Server endpoint can trigger the server-side request forgery condition. Post-exploitation impact includes unauthorized access to internal microservices, exposure of internal APIs, potential remote code execution on adjacent vulnerable internal services, and comprehensive information disclosure regarding the internal network architecture."
}