CVE-2026-65056 mcp-webresearch Server-Side Request Forgery in visit_page Due to Missing Internal-IP Filtering
Attackers can exploit missing IP filtering in mcp-webresearch to access internal network services and retrieve sensitive data via prompt injection.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-65056?
CVE-2026-65056 is a high-severity server-side request forgery vulnerability in mzxrai mcp-webresearch, published on 21 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
mcp-webresearch 0.1.7 contains a server-side request forgery vulnerability that allows attackers to access internal network services by supplying loopback, link-local, or cloud metadata addresses to the visit_page tool, which only validates the URL protocol without filtering private or reserved IP ranges. Attackers can steer the LLM-controlled URL argument through prompt injection to navigate the server's Playwright browser to internal endpoints such as cloud instance metadata services, causing the server to return sensitive internal page content including credentials into the model context.
Weakness: CWE-918
Which versions are affected by CVE-2026-65056?
How do I fix CVE-2026-65056?
No fix has been published for CVE-2026-65056 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-65056 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-65056 exists.
Sources
Also known as GHSA-r9hf-v7rm-5h4j.