mcp-witness

CVE requests

Prepared CVE ID request payloads for the six vulnerabilities disclosed through the mcp-witness disclosure track. The coordinated-disclosure embargo (2026-08-10) has passed and all six are publicly documented, so these are eligible for CVE assignment.

Status: all six submitted to MITRE CNA-LR (Vulnogram) on 2026-09-11; awaiting CVE ID assignment (typically days). Fill in the CAN tracking numbers and the assigned CVE IDs in the submission log below as they arrive.

Submission log

CVE	Package	CAN (tracking)	Assigned CVE ID	Status
A	mcp-server-fetch	CAN-2026-2037396	(pending review)	submitted 2026-09-11
B	mcp-server-http-request	CAN-2026-2037403	(pending review)	submitted 2026-09-11
C	mcp-streamablehttp-proxy	CAN-2026-2037402	(pending review)	submitted 2026-09-11
D	mcp-fetch-streamablehttp-server	CAN-2026-2037401	(pending review)	submitted 2026-09-11
E	fastmcp-http	CAN-2026-2037400	(pending review)	submitted 2026-09-11
F	mcp-server-fetch-sse	CAN-2026-2037399	(pending review)	submitted 2026-09-11

Each entry below maps to the fields on the MITRE CVE request form.

How to submit (MITRE CNA-LR via Vulnogram)

The MITRE CNA of Last Resort (CNA-LR) uses the Vulnogram CVE Services portal. Flow:

1. At the portal, Login with Google (or GitLab) in the popup window. Use didesle7@gmail.com.
2. Click Reserve One CAN. You get a CAN-YYYY-####### tracking number (not yet a CVE ID). Click that CAN link in the ID column.
3. Enter vulnerability details in Vulnogram. Minimum fields, or the request is delayed: Problem types (the CWE), Vendor or project, Product name, Version, Vulnerability Description, References URL. Each entry below maps to these.
4. CVSS is helpful. Paste the suggested CVSS 3.1 vector from the table below (Vulnogram computes the score). If you omit CVSS, click the red × in the upper-right of the Metrics section or the request stalls.
5. Submit Request. Do not treat the CAN number as a public ID until it is accepted.
6. Over the following days the CAN link shows “YOUR REQUEST WAS ACCEPTED AND ASSIGNED THIS CVE ID” with the real CVE ID. Submit one CAN per vulnerability (six, or the subset you choose).

Version field format (Vulnogram): for a package vulnerable in every release through the latest, set one affected product with version: "0", lessThanOrEqual: "<latest>", status: affected, versionType: custom (or semver/python if preferred). For a single-release package (e.g. mcp-server-http-request 0.1.0, mcp-server-fetch-sse 0.1.1), list that exact version with status: affected. The per-CVE “Affected versions” line below gives the range in prose; translate it to that structured form.

Reporter / discoverer credit for every entry: Dishant Desle (didesle7@gmail.com), https://github.com/desledishant10.

Suggested CVSS 3.1 base vectors

These lean deliberately conservative, consistent with the honest severity framing in the descriptions (DNS rebinding is a non-trivial delivery vector, so AC:H on the rebind-only paths; the SSRF impact is credential disclosure, so I:N unless the package also enables direct tool invocation). Vulnogram computes the numeric score from the vector; the CNA may adjust. Adjust or omit per your judgment.

CVE	Product	Suggested CVSS 3.1 vector	Rationale
A	mcp-server-fetch	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N	SSRF; AC:H (needs reachable IMDS + IMDSv2-optional/older + injectable agent); UI:R (agent processes attacker-influenced content); S:C + C:H (cloud IAM credential disclosure)
B	mcp-server-http-request	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N	same SSRF class as A
C	mcp-streamablehttp-proxy	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H	rebind (AC:H, UI:R); worst-case fronts a command-execution server = full compromise (deployment-dependent; lower C/I/A if it fronts a read-only server)
D	mcp-fetch-streamablehttp-server	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N	binds 0.0.0.0 with no auth, so any network host invokes tools directly (AC:L, UI:N); wrapped fetch adds SSRF (C:H); tool invocation (I:L)
E	fastmcp-http	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	binds 0.0.0.0 with no auth, direct tool invocation (AC:L, UI:N); impact bounded by the exposed tools (conservative C:L/I:L)
F	mcp-server-fetch-sse	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N	localhost bind, so rebind path (AC:H, UI:R); browser-driven credential disclosure (C:H)

Strategy note (read before submitting)

• All six are legitimate, real, disclosed, and past embargo. More assigned CVEs is better for a portfolio and a citation record.
• CVE-A (mcp-server-fetch) is the assertive one. It targets Anthropic’s own reference implementation, which the maintainers closed as “not planned.” Requesting it is entirely legitimate (the vulnerability is real, was responsibly disclosed, and the embargo has passed), but it is the highest-visibility filing and puts a CVE against a major vendor’s reference package. Submit it consciously. The other five are community packages with silent or unmaintained maintainers and are lower-friction.
• The two atrawog packages get separate CVEs because they are distinct PyPI products with distinct (though related) defects.
• Consider submitting the five community-package CVEs first, then CVE-A once you have seen how MITRE handles the batch.

Suggested CVSS 4.0 base vectors (the Vulnogram editor defaults to 4.0)

Do not submit the editor’s default all-High vector (that scores 10.0 CRITICAL and is a large overclaim). Paste the per-CVE vector below, or set each metric to match it. In CVSS 4.0, environment-dependence (IMDSv2-optional, DNS-rebind timing) is AT:P (Attack Requirements: Present), and cross-system impact (cloud IAM, a fronted server) is the SC/SI/SA (Subsequent) metrics rather than Scope.

CVE	Product	Suggested CVSS 4.0 vector	Note
A	mcp-server-fetch	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N	SSRF; AT:P (env-dependent IMDS); UI:P (agent processes injected content); SC:H (cloud IAM)
B	mcp-server-http-request	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N	same class as A
C	mcp-streamablehttp-proxy	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H	AT:P (rebind); worst-case fronts a shell server = full compromise (deployment-dependent; lower VC/VI/VA if read-only)
D	mcp-fetch-streamablehttp-server	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N	0.0.0.0 direct reach (AT:N/UI:N); SSRF (VC:H, SC:H); tool invocation (VI:L)
E	fastmcp-http	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N	0.0.0.0 direct reach; tool-bounded impact, no cross-system (SC:N)
F	mcp-server-fetch-sse	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N	localhost rebind (AT:P/UI:P); browser-driven credential disclosure (SC:H)

Vulnogram form cheat-sheet (same answers for every CAN)

• Acknowledge reading the CNA-LR page? yes
• Organization registered for CVE partner onboarding? leave blank
• Have you asked the supplier to assign the CVE ID? supplier wasn't found there (none of these maintainers is a CNA in the partner list; for CVE-A you may instead pick yes - didn't get CVE ID, since the disclosure was filed and closed “not planned”)
• Should the vulnerability be published now? yes (the embargo expired 2026-08-10)
• Problem types: the CWE from the entry (e.g. CWE-918 Server-Side Request Forgery (SSRF))
• Affected products: fill Vendor or project + Product name, and for precision also Package name (the PyPI name) + Package collection URL https://pypi.org
• Versions table: set Default status n; add one row: Affected? y, Version 0, <= Version <latest> (e.g. 2026.8.18, 0.2.0, 0.1.4), versionType custom (calendar/loose versions). For a single-release package, put the exact version (e.g. 0.1.0) in Version with Affected? y.
• Vulnerability Description: paste the entry’s Suggested description (replace the placeholder; do not use Auto Generate, your text is more precise)
• References: add every URL from the entry’s References list (the “Enter a valid URL” one needs at least one)
• Metrics: CVSS 4.0 tab, paste the vector above (or set each metric); the editor computes the score
• Source of vulnerability discovery: external
• Credits: add Dishant Desle, type finder (or reporter)

---

CVE-A: SSRF in mcp-server-fetch

• Vulnerability type (CWE): CWE-918 Server-Side Request Forgery (SSRF)
• Vendor: Anthropic (reference implementation in modelcontextprotocol/servers)
• Product: mcp-server-fetch (PyPI)
• Affected versions: all versions through 2026.8.18 (the current latest; unpatched)
• Attack type: Remote, context-dependent (requires an MCP agent whose fetch tool arguments an attacker can influence, e.g. via prompt injection)
• Impact: Information disclosure (cloud IAM credential theft; internal-service access)
• Suggested description:

  mcp-server-fetch (the reference “fetch” Model Context Protocol server published in modelcontextprotocol/servers) through 2026.8.18 does not validate the URL scheme or the resolved destination IP address of the url argument to its fetch tool before issuing an HTTP request. An MCP agent induced (for example, via prompt injection) to call fetch with a URL targeting a link-local, loopback, or private address causes server-side request forgery. On cloud-hosted agent hosts this includes retrieval of the instance metadata service (e.g. http://169.254.169.254/latest/meta-data/iam/security-credentials/), yielding IAM credentials, as well as access to internal-only HTTP services. On hosts where IMDSv2 is required, retrieval of AWS instance credentials is mitigated at the host level because the server does not send the required token header; SSRF to other reserved-range and internal targets is not mitigated by that control.

• Attack vector: MCP tools/call to the fetch tool with an attacker-influenced URL argument.
• References:
  • Disclosure: https://github.com/modelcontextprotocol/servers/issues/4143 (closed “not planned” 2026-07-30)
  • Proposed fix (unmerged): https://github.com/modelcontextprotocol/servers/pull/4226
  • Reproduction harness: https://github.com/desledishant10/mcp-witness/tree/main/poc/ssrf
  • Technical writeup: https://desledishant10.github.io/mcp-witness/docs/ssrf-mcp-server-fetch
• Discoverer: Dishant Desle

---

CVE-B: SSRF in mcp-server-http-request

• Vulnerability type (CWE): CWE-918 Server-Side Request Forgery (SSRF)
• Vendor: statespace
• Product: mcp-server-http-request (PyPI)
• Affected versions: 0.1.0 (the only release; package is unmaintained per maintainer confirmation)
• Attack type: Remote, context-dependent (attacker-influenced tool arguments)
• Impact: Information disclosure (cloud IAM credential theft; internal-service access)
• Suggested description:

  mcp-server-http-request 0.1.0 exposes MCP tools that issue HTTP requests to a caller-supplied URL without validating the URL scheme or the resolved destination IP address. An MCP agent induced (for example, via prompt injection) to call these tools with a URL targeting a link-local, loopback, or private address causes server-side request forgery, including retrieval of cloud instance metadata (IAM credentials) on affected cloud hosts and access to internal-only HTTP services. The package performs no robots.txt pre-fetch or other outbound-request restriction. On hosts where IMDSv2 is required, retrieval of AWS instance credentials is mitigated at the host level because the tool does not send the required token header; SSRF to other reserved-range and internal targets is not mitigated by that control.

• Attack vector: MCP tools/call to an HTTP-request tool with an attacker-influenced URL argument.
• References:
  • Disclosure record: https://github.com/desledishant10/mcp-witness/blob/main/disclosures/2026-05-12-mcp-fetch-http-request-ssrf.md
  • Maintainer-confirmed unmaintained (2026-06-11).
  • Reproduction (same class as CVE-A): https://github.com/desledishant10/mcp-witness/tree/main/poc/ssrf
• Discoverer: Dishant Desle

---

CVE-C: DNS-rebinding / Origin validation error in mcp-streamablehttp-proxy

• Vulnerability type (CWE): CWE-346 Origin Validation Error (primary); related CWE-350 (Reliance on Reverse DNS)
• Vendor: atrawog (atrawog/mcp-oauth-gateway)
• Product: mcp-streamablehttp-proxy (PyPI)
• Affected versions: through 0.2.0 (current latest; unpatched)
• Attack type: Remote (browser-delivered via DNS rebinding); no authentication required
• Impact: Unauthenticated invocation of the fronted stdio MCP server’s tools (up to remote code execution if it fronts a command-execution server)
• Suggested description:

  mcp-streamablehttp-proxy through 0.2.0 exposes a Streamable HTTP MCP endpoint on a local interface and does not validate the Origin or Host header of inbound requests; a code comment delegates CORS/origin handling to an external Traefik layer that is not present in the standalone package deployment. A web page loaded in the operator’s browser can therefore reach the local endpoint and invoke MCP tools by defeating the browser same-origin host check via DNS rebinding. Because the proxy forwards requests to an arbitrary stdio MCP server, successful exploitation yields unauthenticated invocation of whatever tools that fronted server exposes, up to remote code execution when it fronts a command-execution server. The server-side defect (accepting requests with a mismatched attacker Origin/Host) is directly observable without the rebind; DNS rebinding is the browser delivery vector and must defeat browser DNS caching to land in practice.

• Attack vector: Browser page + attacker-controlled DNS (rebinding) to a local MCP endpoint that omits Origin/Host validation.
• References:
  • Disclosure record: https://github.com/desledishant10/mcp-witness/blob/main/disclosures/2026-05-12-mcp-oauth-gateway-dns-rebinding.md
  • Reproduction harness: https://github.com/desledishant10/mcp-witness/tree/main/poc/dns-rebind
  • Technical writeup: https://desledishant10.github.io/mcp-witness/docs/dns-rebinding-http-mcp-servers
• Discoverer: Dishant Desle

---

CVE-D: DNS-rebinding + permissive CORS in mcp-fetch-streamablehttp-server

• Vulnerability type (CWE): CWE-346 Origin Validation Error (primary); CWE-918 Server-Side Request Forgery (SSRF); CWE-942 Permissive Cross-domain Policy with Untrusted Domains; CWE-1327 Binding to an Unrestricted IP Address
• Vendor: atrawog (atrawog/mcp-oauth-gateway)
• Product: mcp-fetch-streamablehttp-server (PyPI)
• Affected versions: through 0.2.0 (current latest; unpatched)
• Attack type: Remote (browser-delivered, cross-origin and via DNS rebinding); no authentication required
• Impact: Unauthenticated MCP tool invocation; server-side request forgery to cloud metadata / internal services via the wrapped fetch tool
• Suggested description:

  mcp-fetch-streamablehttp-server through 0.2.0 binds its HTTP MCP endpoint to all interfaces (0.0.0.0) by default, does not validate the Origin or Host header of inbound requests, and returns Access-Control-Allow-Origin: * on its responses. A web page can reach the endpoint cross-origin, or same-origin via DNS rebinding, and invoke MCP tools. Because the endpoint is bound to all interfaces without authentication, any host that can route to the port can also invoke the tools directly, independent of a browser. Because the package also wraps a URL-fetch tool that does not validate the URL scheme or resolved IP address, exploitation additionally enables server-side request forgery to internal services and, on hosts where IMDSv2 is not required, to cloud instance metadata (IAM credentials); on IMDSv2-required hosts the AWS-credential path is mitigated because the tool does not send the required token header. The server-side origin-validation defect is directly observable without the rebind; DNS rebinding is the browser delivery vector and must defeat browser DNS caching to land in practice.

• Attack vector: Browser page (cross-origin via wildcard CORS, or same-origin via DNS rebinding) to an all-interfaces MCP endpoint that omits Origin/Host validation.
• References:
  • Disclosure record: https://github.com/desledishant10/mcp-witness/blob/main/disclosures/2026-05-12-mcp-oauth-gateway-dns-rebinding.md
  • Reproduction harness: https://github.com/desledishant10/mcp-witness/tree/main/poc/dns-rebind
  • Technical writeup: https://desledishant10.github.io/mcp-witness/docs/dns-rebinding-http-mcp-servers
• Discoverer: Dishant Desle

---

CVE-E: DNS-rebinding / Origin validation error in fastmcp-http

• Vulnerability type (CWE): CWE-346 Origin Validation Error (primary); CWE-1327 Binding to an Unrestricted IP Address
• Vendor: ARadRareness (ARadRareness/mcp-registry)
• Product: fastmcp-http (PyPI)
• Affected versions: through 0.1.4 (current latest; unpatched)
• Attack type: Remote (browser-delivered via DNS rebinding); no authentication required
• Impact: Unauthenticated invocation of the exposed MCP tools
• Suggested description:

  fastmcp-http through 0.1.4 runs a Flask development server bound to all interfaces (0.0.0.0) with no authentication and no middleware, and does not validate the Origin or Host header of inbound requests. Because the endpoint is bound to all interfaces without authentication, any host that can route to the port can invoke the exposed MCP tools directly, independent of a browser. A web page in the operator’s browser can additionally reach the endpoint by defeating the browser same-origin host check via DNS rebinding. The server-side defect (accepting requests with a mismatched attacker Origin/Host) is directly observable without the rebind; DNS rebinding is the browser delivery vector and must defeat browser DNS caching to land in practice.

• Attack vector: Browser page + attacker-controlled DNS (rebinding) to a local MCP endpoint that omits Origin/Host validation.
• References:
  • Disclosure (public issue): https://github.com/ARadRareness/mcp-registry/issues/3 (closed “completed” 2026-06-21 with no fix)
  • Disclosure record: https://github.com/desledishant10/mcp-witness/blob/main/disclosures/2026-06-02-fastmcp-http-dns-rebinding.md
  • Reproduction harness: https://github.com/desledishant10/mcp-witness/tree/main/poc/dns-rebind
• Discoverer: Dishant Desle

---

CVE-F: DNS-rebinding + inherited SSRF in mcp-server-fetch-sse

• Vulnerability type (CWE): CWE-346 Origin Validation Error (primary); CWE-918 Server-Side Request Forgery (SSRF)
• Vendor: attribution lists Anthropic, PBC in the wheel METADATA; maintainer of record jadamson@anthropic.com. (Author attribution on PyPI is unverified; may be inherited from a fork.)
• Product: mcp-server-fetch-sse (PyPI)
• Affected versions: 0.1.1 (current latest; unpatched)
• Attack type: Remote (fully browser-delivered via DNS rebinding); no agent, no prompt injection, no authentication required
• Impact: Cloud IAM credential theft (on hosts without IMDSv2 required) and internal-service access, driven entirely from a browser tab
• Suggested description:

  mcp-server-fetch-sse 0.1.1 exposes an aiohttp HTTP+SSE Model Context Protocol endpoint that does not validate the Origin or Host header of inbound requests, and its wrapped fetch tool does not validate the URL scheme or resolved destination IP address. Via DNS rebinding, a web page in the operator’s browser can open an SSE session against the local endpoint and issue a tools/call to the fetch tool targeting a cloud instance metadata address (e.g. http://169.254.169.254/), causing the server to return the metadata response to the page; on hosts where IMDSv2 is not required this yields IAM credentials, while on IMDSv2-required hosts the AWS-credential path is mitigated because the fetch tool does not send the required token header (SSRF to other reserved-range and internal targets remains). The full chain is browser-driven and requires no MCP agent or prompt injection. The server-side defects are directly observable without the rebind; DNS rebinding is the browser delivery vector and must defeat browser DNS caching to land in practice.

• Attack vector: Browser page + attacker-controlled DNS (rebinding) opening an SSE session and calling the fetch tool with a metadata URL.
• References:
  • Disclosure record: https://github.com/desledishant10/mcp-witness/blob/main/disclosures/2026-06-02-mcp-server-fetch-sse-dns-rebinding.md
  • Reproduction harness: https://github.com/desledishant10/mcp-witness/tree/main/poc/dns-rebind
  • Technical writeup: https://desledishant10.github.io/mcp-witness/docs/dns-rebinding-http-mcp-servers
• Discoverer: Dishant Desle

---

Shared submission details (paste where the form asks)

• Has the vulnerability been publicly disclosed? Yes. Coordinated disclosure with a 90-day embargo that expired 2026-08-10; technical writeups and reproduction harnesses are public in the mcp-witness repository.
• Is there a fix? CVE-A has an unmerged community fix (PR #4226); the maintainer closed the disclosure as “not planned.” The other five have no fix; maintainers were silent or the package is unmaintained.
• Additional information: All six were surfaced by the open-source scanner mcp-witness (https://github.com/desledishant10/mcp-witness, Apache-2.0). Reproduction is public and does not require the reporter’s involvement.

This site is open source. Improve this page.