CVE-2026-74842

CVE-2026-74842 is an SSRF vulnerability in an MCP server's `download_image` tool function, and it's a symptom of a deeper architectural disease that the security community has seen before — just never quite like this. The function performs outbound URL fetching without validating the target. That's the textbook SSRF pattern, but here's what makes this different: the attack surface runs through the AI assistant itself. In traditional SSRF, an attacker directly manipulates application input. Here, the attacker manipulates the LLM through prompt injection or manipulated context, and the LLM invokes the tool on the attacker's behalf. The server becomes a confused deputy — a trusted intermediary that an attacker cannot directly control but can fool into misusing its authority. This is the confused-deputy problem, first described by Harold Gross in 1988, reactivated through a new delivery mechanism. SSRF itself emerged as a specialization of this lineage, and the field effectively shelved the broader framework when it narrowed to client-server mental models. Now the MCP paradigm adds a second interpretive layer between attacker intent and server action, and the same old vulnerability mutates. What amplifies the risk is the network position of MCP servers. These are architectural chokepoints that typically have elevated outbound access — cloud metadata service permissions, credentials for connected integrations, network paths to internal APIs the public internet cannot reach. The blast radius isn't determined by the vulnerability's sophistication; it's determined by the server's topological privilege. When `download_image` triggers an SSRF, it's fetching from a server that probably reaches sensitive destinations. The EPSS score of 0.00262 reflects historical SSRF patterns and models the wrong threat actor. It assumes the attacker directly touches the application, not that they manipulate the agent controlling it. More critically, the EPSS models exploit likelihood but not remediation likelihood — and in rolling-release ecosystems, those have decoupled. The maintainers received an issue report and haven't responded. The exposure window is effectively infinite. If you're defending against this: treat any MCP server function that performs outbound HTTP requests as a security-sensitive surface, regardless of how it was originally designed. Mandate URL validation on all such tools. Map your integration graph — know what your MCP servers can reach. The vulnerability may be old, but the deployment context is new, and the blast radius is unmapped.

Reviewed through automated stages and approved by a human before publication.