CVE-2026-108542
Received Received - Intake

Server-Side Request Forgery in elvix-sdk MCP Handler

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: VulDB

Description
A vulnerability was found in 021is elvix-sdk up to 0.10.1. Affected by this vulnerability is an unknown functionality of the file src/mcp/index.ts of the component MCP Request Handler. The manipulation of the argument path results in server-side request forgery. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-11
Last Modified
2026-10-11
Generated
2026-10-11
AI Q&A
2026-10-11
EPSS Evaluated
N/A
NVD
CVE-2026-108542
EUVD
EUVD-2026-96863

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
021is elvix-sdk 0.10.0
021is elvix-sdk 0.10.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in the elvix-sdk up to version 0.10.1. It exists in the MCP Request Handler file src/mcp/index.ts where an attacker can manipulate the path argument to send requests to unintended destinations. The vulnerability allows bypassing restrictions on URL schemes, hosts, or ports, enabling access to internal services, loopback interfaces, or external hosts.

Detection Guidance

To detect this SSRF vulnerability in elvix-sdk, inspect network traffic for unexpected outbound requests to internal or loopback addresses (e.g., 127.0.0.1, ::1). Check logs for MCP tool interactions with suspicious paths or hosts. Use tools like curl or wget to test if the MCP request handler accepts arbitrary URLs without restrictions.

Impact Analysis

An attacker could exploit this to send requests to internal systems, cloud metadata endpoints, or attacker-controlled hosts. This may lead to unauthorized access to sensitive data, disclosure of API keys, or further attacks on internal services. The impact includes potential data breaches, service disruption, or privilege escalation depending on the exposed services.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations using this SDK may face compliance violations, legal penalties, or reputational damage due to potential data leaks or unauthorized access to sensitive systems.

Mitigation Strategies

Immediately disable all MCP tools in the elvix-sdk, especially those in administrative mode. Restrict outbound network access to prevent SSRF attacks. Monitor for unauthorized API key disclosures. Since no patch exists, consider isolating affected systems or migrating to alternative solutions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108542. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart