CVE-2026-108786
Received Received - Intake

Server-Side Request Forgery in houtini-ai SEO Crawler MCP

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulDB

Description
A vulnerability has been found in houtini-ai seo-crawler-mcp up to 2.1.5. Impacted is the function run_seo_audit of the file src/core/CrawlOrchestrator.ts of the component Crawler. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-108786
EUVD
EUVD-2026-97143

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
houtini-ai seo-crawler-mcp 2.1.0
houtini-ai seo-crawler-mcp 2.1.1
houtini-ai seo-crawler-mcp 2.1.2
houtini-ai seo-crawler-mcp 2.1.3
houtini-ai seo-crawler-mcp 2.1.4
houtini-ai seo-crawler-mcp 2.1.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in the houtini-ai seo-crawler-mcp tool up to version 2.1.5. It allows attackers to manipulate the tool into sending HTTP requests to arbitrary internal network addresses, including localhost and private IP ranges, by providing a user-controlled URL without proper validation.

Detection Guidance

To detect this SSRF vulnerability in houtini-ai seo-crawler-mcp, monitor outbound HTTP requests from the application, especially to localhost or private IP ranges. Check server logs for unusual URLs or requests to internal services. Use network monitoring tools like tcpdump or Wireshark to capture traffic from the application process.

Impact Analysis

An attacker could exploit this to access internal systems, bypass firewalls, or interact with services running on localhost. This could lead to data theft, service disruption, or further network compromise if internal services are vulnerable.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations may face compliance violations if internal systems are accessed.

Mitigation Strategies

Immediately upgrade to a patched version if available. If not, restrict outbound network access for the application using firewalls or network policies. Block requests to localhost, private IP ranges, and loopback addresses. Implement strict URL validation to allow only trusted domains and protocols.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108786. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart