Description

A flaw has been found in jkawamoto mcp-florence2 up to 0.3.13. Affected by this issue is the function get_images of the file src/mcp_florence2/__init__.py. This manipulation of the argument src causes server-side request forgery. The attack may be initiated remotely. The exploit has been published and may be used. It is recommended to change the configuration settings. The vendor explains: "For deployments where SSRF protection is required, I recommend routing all HTTP(S) requests through an SSRF-safe proxy server. This approach mitigates the vulnerability without requiring changes to the mcp-florence2 source code."

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-17T05:17:10.127Z",
  "pubdate": "2026-08-17T05:17:10.127Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability has been identified in jkawamoto mcp-florence2 up to version 0.3.13. The vulnerability resides in the get_images function within the src/mcp_florence2/__init__.py file. Remote attackers can manipulate the src argument to force the server into making unauthorized outbound HTTP or HTTPS requests to arbitrary destinations.\nThis flaw exposes internal network resources, sensitive metadata endpoints, and external services to potential abuse. The attack vector is fully remote and an exploit has been published, increasing the risk of active exploitation. The vendor has explicitly stated that no code-level patch is provided within the source code, advising instead that deployments requiring SSRF protection must route all HTTP and HTTPS requests through an SSRF-safe proxy server.",
  "technicalDetails": "The vulnerability is caused by improper input validation and handling of the src argument passed to the get_images function within src/mcp_florence2/__init__.py for jkawamoto mcp-florence2 versions up to 0.3.13. The function directly processes user-supplied input to retrieve image data via HTTP or HTTPS protocols without validating or restricting the destination Uniform Resource Locator (URL).\nBecause the application executes network requests based on externally controlled parameters, an unauthenticated remote attacker can supply crafted URIs targeting internal services, local loopback addresses (127.0.0.1, ::1), or cloud metadata services. The network exposure is inherent to the service handling remote inputs, allowing arbitrary outbound connection attempts directly from the host running the vulnerable application.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious payload containing an internal or restricted network address within the src parameter. Second, the attacker transmits the payload remotely to the vulnerable mcp-florence2 endpoint invoking the get_images function. Third, the application parses the input and initiates an unvalidated outbound HTTP or HTTPS request toward the attacker-specified target. Finally, the application processes the response or reflects operational status, allowing the attacker to probe internal network perimeters, bypass perimeter firewalls, or interact with non-public backend APIs."
}