CVE-2026-19040
Received Received - Intake

Server-Side Request Forgery in MissionSquad mcp-api

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: VulDB

Description
A flaw has been found in MissionSquad mcp-api up to 1.11.9. The affected element is an unknown function of the file src/services/dcrClients.ts. Executing a manipulation can lead to server-side request forgery. The attack may be performed from remote. Upgrading to version 1.11.10 is sufficient to fix this issue. This patch is called f068ab4ad6f0907ac7001b995588c2673f11a755. You should upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2026-19040
EUVD
EUVD-2026-53924

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
missionsquad mcp-api to 1.11.9 (inc)
missionsquad mcp-api to 1.11.10 (exc)
missionsquad mcp-api 1.11.10

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in MissionSquad mcp-api up to version 1.11.9. It occurs in the OAuth Dynamic Client Registration (DCR) flow where the registrationEndpoint URL is not properly validated before the server makes a POST request to it. Attackers can manipulate this URL to coerce the server into sending requests to internal or loopback addresses, potentially accessing unauthorized services or data.

Detection Guidance

To detect this SSRF vulnerability in MissionSquad mcp-api, check if your system is running version 1.11.9 or earlier. Inspect the OAuth Dynamic Client Registration (DCR) flow for improper validation of the registrationEndpoint URL. Look for logs showing POST requests to internal or loopback addresses like 127.0.0.1 or private IP ranges.

Impact Analysis

An attacker could exploit this to make the server send requests to internal systems, potentially accessing sensitive data or services. This could lead to unauthorized access, data leaks, or further attacks on internal infrastructure. The impact depends on the server's internal network and services.

Mitigation Strategies

Upgrade MissionSquad mcp-api to version 1.11.10 or later. This version includes SSRF protections for the registrationEndpoint URL. Ensure the fix validates URLs during persistence and before fetch() calls to block unsafe destinations like loopback or private IPs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19040. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart