CVE-2026-19340
Received Received - Intake

Server-Side Request Forgery in ProjectHub-Mcp

Publication date: 2026-08-09

Last updated on: 2026-08-09

Assigner: VulDB

Description
A weakness has been identified in anubissbe ProjectHub-Mcp up to 5.0.0. This affects an unknown function of the file backend-fix/complete_backend.js of the component Webhooks API. This manipulation of the argument url causes server-side request forgery. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-09
Last Modified
2026-08-09
Generated
2026-08-09
AI Q&A
2026-08-09
EPSS Evaluated
N/A
NVD
CVE-2026-19340
EUVD
EUVD-2026-54909

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
anubissbe projecthub-mcp to 5.0.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Server-Side Request Forgery (SSRF) in the ProjectHub-Mcp application up to version 5.0.0. It exists in the Webhooks API where the backend server sends HTTP requests to user-provided URLs without proper validation. An attacker can manipulate the 'url' parameter in the webhook configuration to force the server to send requests to arbitrary destinations, including internal or loopback addresses like 127.0.0.1.

Detection Guidance

To detect this SSRF vulnerability in ProjectHub-Mcp, monitor network traffic for outbound requests from your backend server to unexpected or internal destinations. Check logs for POST requests to /api/webhooks with arbitrary URLs, especially loopback or private IPs. Use tools like tcpdump or Wireshark to capture outgoing connections from the Node.js process.

Impact Analysis

This SSRF vulnerability could allow an attacker to access internal services, scan internal networks, or interact with other systems running on the same server as ProjectHub-Mcp. It may lead to unauthorized data exposure, service disruption, or further exploitation of internal resources if the server has access to sensitive systems.

Compliance Impact

This SSRF vulnerability could potentially violate compliance requirements such as GDPR (data protection) or HIPAA (health information security) by exposing internal systems or sensitive data. Organizations using this software may face compliance risks if the vulnerability leads to unauthorized access to protected information or internal resources.

Mitigation Strategies

Immediately update the webhook URL validation in backend-fix/complete_backend.js to reject loopback, private, and restricted IP ranges. Apply the same SSRF protections used in backend-fix/server.js to this file. Disable the webhook test endpoint if not critical. Monitor for suspicious outbound requests until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19340. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart