CVE-2026-15750

Deferred Deferred - Pending Action

Server-Side Request Forgery in MasterGo Design mastergo-magic-mcp

Publication date: 2026-07-14

Last updated on: 2026-07-15

Assigner: VulDB

Description

A weakness has been identified in mastergo-design mastergo-magic-mcp up to 0.2.0. Impacted is the function z.string of the file src/tools/get-component-link.ts of the component mcp__getComponentLink. Executing a manipulation of the argument url can lead to server-side request forgery. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-15750

EUVD

EUVD-2026-44515

Affected Vendors & Products

Vendor	Product	Version / Range
mastergo	mastergo-magic-mcp	to 0.2.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability is a server-side request forgery (SSRF) in the mastergo-magic-mcp component up to version 0.2.0. It exists in the z.string function of the file src/tools/get-component-link.ts. By manipulating the url argument, an attacker can force the server to make unauthorized requests to internal or external systems.

Detection Guidance

This vulnerability involves server-side request forgery (SSRF) in the z.string function of mastergo-magic-mcp. To detect it, inspect network traffic for unusual outbound requests from the affected component, particularly those involving the url argument. Check logs for requests to internal or external systems that shouldn't be accessed. Validate if the application processes user-controlled URLs without proper sanitization.

Impact Analysis

This vulnerability allows remote attackers to perform SSRF attacks, potentially accessing internal services, exfiltrating data, or making requests on behalf of the server. It could lead to unauthorized actions, data breaches, or further network compromise if exploited.

Compliance Impact

SSRF vulnerabilities can lead to data breaches, unauthorized access to sensitive information, or exposure of protected data, which may violate GDPR, HIPAA, or other compliance requirements. Organizations must address this to maintain regulatory compliance.

Mitigation Strategies

Immediately update mastergo-magic-mcp to the latest version beyond 0.2.0 to address the server-side request forgery vulnerability in the z.string function. If an update is not available, consider disabling the affected component or restricting network access to it until a patch is released.

Hi! I’m here to help you understand CVE-2026-15750. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70