CVE-2026-19984: A flaw has been found in jkawamoto mcp-florence2 up to 0

What it is

CVE-2026-19984 is a server-side request forgery (CWE-918) in jkawamoto's mcp-florence2 up to 0.3.13, published 2026-08-17 and currently marked Deferred in NVD. The summary already covers the mechanism and the vendor's proxy-based mitigation; what it omits is the severity math, which points the other way.

Severity — the reason to read this

NVD assigns a CVSS 4.0 base score of 2.1 (LOW), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P. Two components should reset expectations set by the words "remote SSRF with public exploit":

• PR:L — the attacker needs low-level privileges on the server, not unauthenticated access. This is not an open-internet drive-by.
• VC:L / VI:L / VA:L, SC:N / SI:N / SA:N — confidentiality, integrity and availability impact are all rated Low, and there is no scope change. The SSRF does not, in NVD's scoring, cross into the surrounding system.
• E:P — exploit maturity is "Proof-of-Concept," consistent with the summary's "public exploit," but the maturity is PoC, not weaponized/attacked-in-the-wild.

The net is a low-urgency finding: real, remotely reachable, but gated behind privileges and scored as low-impact.

What to do

The vendor declines to patch source and instead recommends configuration change — route all HTTP(S) through an SSRF-safe egress proxy. Verbatim:

"For deployments where SSRF protection is required, I recommend routing all HTTP(S) requests through an SSRF-safe proxy server. This approach mitigates the vulnerability without requiring changes to the mcp-florence2 source code."

For triage: treat this as a configuration hardening task, not an emergency patch. If your mcp-florence2 instance is reachable only by trusted, already-authenticated callers and has no path to sensitive internal endpoints, the LOW score and PR:L requirement justify deferring — matching NVD's own "Deferred" status. If it fronts a network with reachable internal metadata or admin services, put the egress proxy in place.

Caveats

• Score is base-metric only; environmental/threat metrics are all X (undefined), so your own exposure could raise it.
• The vulnerability is confirmed via VulDB (submission 873920, entry 391184) and tracked in the project's issue #59; the "Deferred" status means NVD is not prioritizing further analysis, not that the flaw is disputed.