Description

A vulnerability was identified in graphlit graphlit-mcp-server 1.0.1. This affects the function fetch of the file src/tools.ts of the component ssrf-test Endpoint. Such manipulation of the argument url leads to server-side request forgery. The attack may be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-16T22:16:28.970Z",
  "pubdate": "2026-08-16T22:16:28.970Z",
  "executiveSummary": "A Server-Side Request Forgery vulnerability has been identified in the graphlit graphlit-mcp-server version 1.0.1. The flaw resides in the ssrf-test Endpoint component, specifically within the fetch function of the src/tools.ts file. This vulnerability enables remote attackers to manipulate the url argument, forcing the affected system to dispatch arbitrary outbound HTTP requests to internal or external destinations. Successful exploitation of this vulnerability can lead to severe security implications, including unauthorized access to internal network resources, information disclosure of sensitive metadata services, and potential pivoting within the internal infrastructure. The attack vector is remotely accessible, and a public exploit is currently available, heightening the immediate risk to deployed instances. The vendor was notified of the security defect via an issue report but has not yet provided an official response or patch, leaving deployments exposed unless manual defensive measures are enforced.",
  "technicalDetails": "The vulnerability is classified as Server-Side Request Forgery, stemming from insufficient input validation and sanitization of user-supplied data utilized in outbound network requests. The vulnerable component is the ssrf-test Endpoint implemented within the graphlit graphlit-mcp-server version 1.0.1. Specifically, the flaw exists in the fetch function located in the src/tools.ts file, where the argument url is accepted and processed without adequate restriction or validation against an allowlist of permitted domains or destination IP ranges.\nThe attack flow proceeds as follows: An unauthenticated or remotely positioned malicious actor supplies a crafted URI targeting internal infrastructure, loopback addresses (127.0.0.1 / localhost), cloud metadata endpoints (e.g., 169.254.169.254), or restricted internal microservices to the vulnerable url parameter. The fetch function in src/tools.ts processes this input and initiates a direct HTTP request from the host executing the graphlit-mcp-server. Because the application blindly trusts and retrieves the resource specified by the manipulated argument, the server acts as a proxy for the attacker.\nNetwork exposure is fully remote, requiring network connectivity to the graphlit-mcp-server instance. Depending on the deployment architecture, the vulnerability may be exploited without authentication or elevated privileges if the ssrf-test Endpoint is exposed to untrusted networks. Payload behavior involves outbound connections originating from the vulnerable server, allowing the attacker to read responses or interact with services bound exclusively to the local loopback interface or protected behind a perimeter firewall. Post-exploitation impact encompasses internal reconnaissance, extraction of cloud instance metadata credentials, interaction with internal APIs, and potential execution of secondary attacks against vulnerable backend components."
}