CVE-2026-19765
Received Received - Intake

Server-Side Request Forgery in swagger-testcase-mcp

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulDB

Description
A security flaw has been discovered in eyaushev swagger-testcase-mcp 5babb27c951fb404bc2b25ec80593616e49054e5. This vulnerability affects the function loadSource of the file src/utils/swagger-parser.ts of the component fetch_swagger. Performing a manipulation results in server-side request forgery. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-19765
EUVD
EUVD-2026-58559

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
eyaushev swagger-testcase-mcp to 1.0.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Server-Side Request Forgery (SSRF) flaw in the swagger-testcase-mcp tool. It occurs because the source parameter in the loadSource function is not properly validated. Attackers can manipulate this to make the server send HTTP requests to internal systems or attacker-controlled targets. The issue affects multiple tools within the project that use the shared loadSource function.

Detection Guidance

To detect this SSRF vulnerability, monitor network traffic for unexpected outbound requests from the swagger-testcase-mcp server. Check logs for unusual source parameter values or HTTP requests to internal addresses like localhost, 127.0.0.1, or private network ranges. Use tools like tcpdump or Wireshark to inspect traffic originating from the server process.

Impact Analysis

An attacker could exploit this to access internal network resources, exfiltrate sensitive data, or interact with services not intended for public access. The server may fetch and process attacker-selected URLs, potentially leading to unauthorized data exposure or further network compromise.

Compliance Impact

This SSRF vulnerability could lead to unauthorized data access or exfiltration, violating confidentiality requirements in GDPR and HIPAA. Organizations using this tool may face compliance violations if sensitive data is exposed due to the flaw.

Mitigation Strategies

Immediately restrict network access for the swagger-testcase-mcp server to prevent outbound requests. Update the loadSource function to validate and sanitize the source parameter, ensuring it only accepts trusted URLs and blocks localhost, private IPs, and cloud metadata endpoints. Disable or remove the MCP server if not essential.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19765. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart