CVE-2026-108787
Received Received - Intake

Server-Side Request Forgery in houtini-ai voice-analyser-mcp

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulDB

Description
A vulnerability was found in houtini-ai voice-analyser-mcp up to 2.1.1. The affected element is the function fetch of the file src/utils/crawler.ts of the component collect_corpus. Performing a manipulation of the argument sitemap_url results in server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-108787
EUVD
EUVD-2026-97144

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
houtini-ai voice-analyser-mcp 2.1.0
houtini-ai voice-analyser-mcp 2.1.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in the houtini-ai voice-analyser-mcp tool up to version 2.1.1. It allows attackers to manipulate the sitemap_url parameter to force the application to make HTTP requests to arbitrary internal network addresses, including localhost, private IPs, and cloud metadata endpoints.

Detection Guidance

To detect this SSRF vulnerability in houtini-ai voice-analyser-mcp, monitor outbound HTTP requests from the application, especially those targeting localhost, private IP ranges (10.x, 172.16.x, 192.168.x), or cloud metadata endpoints like 169.254.169.254. Check logs for unusual requests to internal services or unexpected domains in the sitemap_url parameter.

Commands to inspect network activity include: netstat -tuln to check listening ports, ss -tuln for active connections, and tcpdump or Wireshark to capture outbound traffic. Review application logs for requests to suspicious URLs or internal IPs.

Impact Analysis

An attacker could exploit this to access internal services, perform network scanning, steal cloud metadata, or bypass firewalls. This could lead to unauthorized data access, service disruption, or further network compromise depending on the internal network configuration.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations using this software may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Immediately update voice-analyser-mcp to the latest version if available. If not, implement strict URL validation to block localhost, private IPs, link-local addresses, and cloud metadata endpoints in the sitemap_url parameter. Enforce HTTPS/HTTP-only protocols and use URL whitelisting for allowed domains.

Add rate limiting to prevent abuse, log all outbound requests for monitoring, and restrict network access to internal services. If possible, isolate the application in a sandboxed environment with limited network permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108787. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart