{"answers":{"affected":"2 open source packages ship an affected version, including @cardano402/mcp-server.","exploited":"There is no known exploitation of GHSA-rp72-5v5q-2446 in the wild and no public exploit code.","fix":"Upgrade @cardano402/mcp-server to 0.1.2 or later.","what":"GHSA-rp72-5v5q-2446 is a server-side request forgery vulnerability in @cardano402/mcp-server, published on 26 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-rp72-5v5q-2446 and fix it if it is affected.\n\nWhat it is: GHSA-rp72-5v5q-2446 is a server-side request forgery vulnerability in @cardano402/mcp-server, published on 26 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-rp72-5v5q-2446 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- @cardano402/mcp-server (npm): affected all versions; fixed in 0.1.2\n- @cardano402/mcp-server (npm): affected all versions; fixed in 0.1.2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-rp72-5v5q-2446/ (Markdown: https://insights.sbomify.com/GHSA-rp72-5v5q-2446/index.md)","id":"GHSA-rp72-5v5q-2446","markdown":"https://insights.sbomify.com/GHSA-rp72-5v5q-2446/index.md","name":"GHSA-rp72-5v5q-2446","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_read","privilege_escalation"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Cardano MCP server","requires_auth":"none","summary":"Attackers can trigger SSRF to access internal metadata or drain funds via unauthenticated LAN access and missing spending limits in the Cardano MCP server.","user_interaction":"not_required","vuln_class":"ssrf"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"## Summary\n`@cardano402/mcp-server` versions `\u003c= 0.1.1` ship three security gaps that can lead to unauthorized fund movement when the package is used as designed (an MCP server exposing Cardano payment tools to an\n\n## Impact\n### 1. No spending limits on signed payments\nAn LLM (or prompt-injected LLM) calling tools registered by the MCP server can invoke them in a loop. Each call signs a real Cardano transaction for the catalog-advertised amount. There is no per-call cap, daily ceiling, MCP elicitation/confirmation step, or recipient allowlist. The `MAINNET=true` env-var guardrail can be bypassed by any LLM with shell-tool access. Worst case: full wallet drain.\n\n### 2. HTTP transport binds 0.0.0.0 without authentication\n`cardano402-mcp --transport http` listens on all interfaces with no `Origin` allowlist, no bearer-token requirement, and no CORS check. Anyone on the same LAN can POST MCP `tools/call` and trigger signed payments from the operator's wallet.\n\n### 3. SSRF via `catalog.server.url`\nA malicious catalog can declare a `server.url` pointing at internal infrastructure (e.g. `http://169.254.169.254/latest/meta-data`). The `allowInsecure` guard in 0.1.1 only checks the catalog URL itself, not the `server.url` it returns. `endpoint.path` is also not normalized, so `..` traversal or absolute URLs work.\n\n## Patches\nFixed in `@cardano402/mcp-server@0.1.2`:\n  - Per-call and per-day spending limits (default 5 ADA / 50 ADA) + optional recipient allowlist + MCP `elicitation/create` confirmation hook.\n  - HTTP transport defaults to `127.0.0.1`; non-loopback requires `--http-bearer-token`; per-request `Origin` allowlist + bearer check.\n  - `catalog.server.url` validated against private-CIDR rules (RFC1918, RFC4193, link-local, CGNAT, multicast, IPv4-mapped IPv6, loopback) unless `CARDANO402_ALLOW_INSECURE=true`.\n  - `endpoint.path` rejected if it contains `..`, NUL, whitespace/CRLF, an absolute URL, or `//host/...`.\n  - Per-tool mainnet opt-in via `--mainnet-confirmed-tools`.\n\n  ## Workarounds for 0.1.1 users\n  - Do not run with `--transport http` on an untrusted network; use `--transport stdio` (default).\n  - Only point the server at catalogs you control or have audited.\n  - Use a low-balance hot wallet, never your main wallet.\n  - Avoid `MAINNET=true` until upgraded to 0.1.2.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"@cardano402/mcp-server missing spending limits, LAN-exposed HTTP transport, and SSRF via catalog.server.url","id":"GHSA-rp72-5v5q-2446","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"npm","product":null,"products":[],"type":"ssrf","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"npm","fixed":["0.1.2"],"introduced":["0"],"last_affected":[],"package":"@cardano402/mcp-server","purl":null,"source":"GHSA-rp72-5v5q-2446"},{"ecosystem":"npm","fixed":["0.1.2"],"introduced":["0"],"last_affected":[],"package":"@cardano402/mcp-server","purl":"pkg:npm/%40cardano402/mcp-server","source":"GHSA-rp72-5v5q-2446"}],"products":null,"published":"2026-06-26","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers can trigger SSRF to access internal metadata or drain funds via unauthenticated LAN access and missing spending limits in the Cardano MCP server.","url":"https://insights.sbomify.com/GHSA-rp72-5v5q-2446/"}