Skip to content

Back to the catalog

nvd.nist.govadvisory

CVE-2026-65056: mcp-webresearch 0

CVE-2026-65056 describes a server-side request forgery in the mcp-webresearch MCP server (npm package @mzxrai/mcp-webresearch, v0.1.7), scoring CVSS 4.0 8.3 HIGH. The visit_page tool only validates URL protocol and does not filter private, loopback, link-local, or cloud metadata IP ranges, so an attacker who controls the LLM-supplied URL argument (e.g. via prompt injection) can steer the server's Playwright browser to internal endpoints like cloud instance metadata services and exfiltrate sensitive internal content, including credentials, back into the model context.

TL;DR SSRF in the mcp-webresearch MCP tool's visit_page lets prompt-injected URLs reach internal/cloud-metadata endpoints and leak credentials into the LLM context.
Open original ↗

Organisations named here

  • CWE-918

CVEs named here

  • CVE-2026-65056

Technologies named here

  • mcp-webresearch
  • Playwright
  • Model Context Protocol
  • npm

Techniques named here

  • Prompt Injection
  • SSRF

Related in AI Security