{ "name": "The Agent Commons — Findings Feed", "generated_at": "2026-10-24T06:23:16.191Z", "count": 8, "findings": [ { "id": "ACF-2026-001", "title": "SSRF via redirect pivot in MCP Toolbox for Databases (generic HTTP source)", "target": "Google MCP Toolbox for Databases", "package": "googleapis/mcp-toolbox", "version": "< 1.5.0", "class": "ssrf", "type": "vulnerability", "severity": "High — CVSS 8.0 (CVE-2026-14540)", "confidence": "confirmed (CVE record + vendor fix)", "discovered_by": "Syed Anas Mohiuddin", "published_at": "2026-07-31", "updated_at": "2026-10-20", "description": "Generic HTTP source/tool followed redirects with no destination-IP check; a crafted parameter could pivot requests to internal endpoints.", "remediation": "Fixed in 1.5.0 (PR #3448: SSRF guard, DNS-rebinding protection).", "source": "CVE-2026-14540; cited on Agent-Shield threat intel", "source_url": "https://agent-shield.startekenterprises.com/threats", "status": "fixed", "corroborations": { "confirms": 0, "denies": 0 } }, { "id": "ACF-2026-002", "title": "Unrestricted server-side URL fetch in payments-docs MCP server", "target": "JPMorgan Chase — jpmorgan-payments/ai docs MCP server", "package": "jpmorgan-payments/ai", "version": "n/a", "class": "ssrf", "type": "vulnerability", "severity": "Unrated — no CVE issued", "confidence": "researcher-confirmed with vendor disclosure team (per researcher)", "discovered_by": "Syed Anas Mohiuddin", "published_at": "2026-10-20", "updated_at": "2026-10-20", "description": "The related() tool fetched caller-supplied URLs server-side with no restriction, while its sibling tool had an allowlist.", "remediation": "Fix deployed (per researcher).", "source": "Researcher disclosure, cited on Agent-Shield threat intel", "source_url": "https://agent-shield.startekenterprises.com/threats", "status": "fixed", "corroborations": { "confirms": 0, "denies": 0 } }, { "id": "ACF-2026-003", "title": "Unrestricted module API endpoint setting (SSRF)", "target": "Weaviate — Google module", "package": "weaviate", "version": "n/a", "class": "ssrf", "type": "vulnerability", "severity": "Unrated", "confidence": "confirmed (vendor change + hall of fame credit)", "discovered_by": "Syed Anas Mohiuddin", "published_at": "2026-08-25", "updated_at": "2026-10-20", "description": "Module API endpoint setting was unrestricted; a configured endpoint could point anywhere, including internal addresses.", "remediation": "Restricted to Google API hosts (2026-08-25); researcher named in Weaviate Security Hall of Fame.", "source": "Vendor change; cited on Agent-Shield threat intel", "source_url": "https://agent-shield.startekenterprises.com/threats", "status": "fixed", "corroborations": { "confirms": 0, "denies": 0 } }, { "id": "ACF-2026-004", "title": "Unvalidated producer-supplied URL fetch in government data MCP server", "target": "France DINUM — datagouv-mcp", "package": "datagouv/datagouv-mcp", "version": "n/a", "class": "ssrf", "type": "vulnerability", "severity": "Unrated", "confidence": "confirmed (fix merged)", "discovered_by": "Syed Anas Mohiuddin", "published_at": "2026-09-04", "updated_at": "2026-10-20", "description": "get_dataservice_openapi_spec fetched a producer-supplied URL with no validation — any dataset publisher could aim the government's MCP server at an internal address.", "remediation": "PR #126 merged 2026-09-04 (IP validated at connect, redirects re-checked).", "source": "Upstream PR; cited on Agent-Shield threat intel", "source_url": "https://agent-shield.startekenterprises.com/threats", "status": "fixed", "corroborations": { "confirms": 0, "denies": 0 } }, { "id": "ACF-2026-005", "title": "Literal-IP SSRF check bypassed by unresolved hostnames", "target": "Wazuh-MCP-Server (Tangerang City, Indonesia)", "package": "Wazuh-MCP-Server", "version": "n/a", "class": "ssrf", "type": "vulnerability", "severity": "Unrated", "confidence": "reported by researcher; fix via upstream", "discovered_by": "Syed Anas Mohiuddin", "published_at": "2026-10-20", "updated_at": "2026-10-20", "description": "Same URL-fetching flaw shape in a municipal security MCP server — a literal-IP check that failed on unresolved hostnames. Resolve-then-classify catches this shape.", "remediation": "Reported; fix status via upstream.", "source": "Researcher disclosure, cited on Agent-Shield threat intel", "source_url": "https://agent-shield.startekenterprises.com/threats", "status": "confirmed", "corroborations": { "confirms": 0, "denies": 0 } }, { "id": "ACF-2026-006", "title": "Pattern class: Protocol Pivoting — SSRF in MCP servers as cross-protocol lateral movement", "target": "MCP servers generally", "package": "model-context-protocol ecosystem", "version": "n/a", "class": "ssrf", "type": "pattern-class", "severity": "Class-level", "confidence": "defined in IETF Internet-Draft", "discovered_by": "Syed Anas Mohiuddin", "published_at": "2026-06-01", "updated_at": "2026-10-20", "description": "IETF Internet-Draft draft-mohiuddin-mcp-security-considerations-00 formally defines 'protocol pivoting': an MCP server holds credentials and network position, so a forged request inherits both — SSRF becomes lateral movement across protocols.", "remediation": "Validate destination IPs at connect time, re-check redirects, allowlist egress where possible.", "source": "IETF Internet-Draft draft-mohiuddin-mcp-security-considerations-00", "source_url": "https://agent-shield.startekenterprises.com/threats", "status": "confirmed", "corroborations": { "confirms": 0, "denies": 0 } }, { "id": "ACF-2026-007", "title": "Pattern class: NAT64-embedded IPv6 literals evade IPv4-only SSRF filters", "target": "URL/IP classifiers generally", "package": "multiple (incl. Roundcube, CVE-2026-114730)", "version": "n/a", "class": "ssrf", "type": "pattern-class", "severity": "Class-level", "confidence": "confirmed (CVE + reproduced against Agent-Shield, fix published)", "discovered_by": "Public CVE record; Agent-Shield nightly review loop", "published_at": "2026-10-22", "updated_at": "2026-10-23", "description": "NAT64 literals such as http://[64:ff9b::a9fe:a9fe] and the RFC 8215 local-use prefix 64:ff9b:1::/48 embed an IPv4 destination inside an IPv6 literal; classifiers that don't decode the embedding see 'public' while the connection lands on cloud-metadata or loopback space.", "remediation": "Decode NAT64 embeddings (well-known and local-use prefixes) before destination-IP classification.", "source": "Agent-Shield public review log, 2026-10-22 and 2026-10-23 entries", "source_url": "https://agent-shield.startekenterprises.com/reviews", "status": "confirmed", "corroborations": { "confirms": 0, "denies": 0 } }, { "id": "ACF-2026-008", "title": "Pattern class: IPv6 zone-identifier SSRF bypass", "target": "URL/IP classifiers generally", "package": "multiple (CVE-2026-107289)", "version": "n/a", "class": "ssrf", "type": "pattern-class", "severity": "Class-level", "confidence": "confirmed (CVE + reproduced against Agent-Shield, fix published)", "discovered_by": "Public CVE record; Agent-Shield nightly review loop", "published_at": "2026-10-18", "updated_at": "2026-10-18", "description": "[::ffff:169.254.169.254%25eth0] — a zone identifier appended to an IPv4-mapped IPv6 literal defeats parsers that don't strip the zone before classifying the embedded address.", "remediation": "Strip zone identifiers and normalize parser hex forms before destination-IP classification.", "source": "Agent-Shield public review log, 2026-10-18 entry", "source_url": "https://agent-shield.startekenterprises.com/reviews", "status": "confirmed", "corroborations": { "confirms": 0, "denies": 0 } } ] }