nvd.nist.govadvisory

CVE-2026-14748: A flaw has been found in AIAnytime Awesome-MCP-Server up to a884bb51bcd99e08e14fd712c749d55d9d9a13ab

CVE-2026-14748 is a low-severity (CVSS 4.0: 2.1) server-side request forgery flaw in AIAnytime's Awesome-MCP-Server, specifically in the mcp-wiki/wiki-summary component's server.py, where the url argument is not validated before the server fetches it. A remote, low-privilege attacker can abuse this to make the MCP server issue arbitrary outbound requests; the exploit has already been published via GitHub issues and the maintainer has not responded to the disclosure.