CVE-2026-19752

This CVE presents as a straightforward SSRF in a document parsing function, but treating it as a medium-severity web vulnerability fundamentally mischaracterizes the risk. The vulnerable component is an MCP layer — a bridge between AI agents and external tools — and MCP layers operate under a different trust model than traditional code. When a function accepts a URL parameter, that parameter can be populated not just by direct HTTP manipulation but by conversational language, RAG context, or chained tool outputs. An attacker doesn't scan a port; they convince an AI agent to request 'internal-host/confidential.pdf' through natural dialogue. The agent, which likely holds cloud credentials, database access, or internal network privileges the developer never intended to expose, becomes the unwitting SSRF client making the request from inside the firewall with real credentials. That's not server-side request forgery — it's trust relationship hijack. Compounding this: the maintainer was notified early and has not engaged. For a traditional library, you'd fork and patch. For an MCP layer embedded in agent configurations, you face a structural remediation dead-end — the layer's specific output format and behavioral contracts may be woven into your workflow, and without a maintained fork, there's no clean upgrade path. The CVE will generate tickets routed to teams looking for a patch version that won't arrive. The distinction this note demands you internalize: this is not a vulnerability to remediate — it's a dependency to remove. The EPSS score and CVSS rating will classify this as monitorable; the actual risk is that every AI agent integrated with this layer represents a growing attack surface with no decay mechanism, because the exposure window doesn't narrow over time — it compounds with each new integration during the silent pre-response period. Model your AI agents' credential scope. If those agents have cloud access, internal API reach, or persistent conversation context, this SSRF transforms into a trust hijack with blast radius that scales with the agent's privileges, not the function's.

Reviewed through automated stages and approved by a human before publication.