SSRF in Anthropic mcp-server-fetch and Microsoft playwright-mcp — publicly disclosed via GitHub issues

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-05-26 01:44 UTC
Importiert: 2026-06-16 07:20 UTC
Quelle-ID: full_disc
uid_hash: c7fca8339337ee3953feede22cef1ec0bee95363391c85c38014a898fa6d0da0

Full Disclosure

Posted by outreach on May 25 -----BEGIN SECURITY ADVISORY-----

Title: Server-Side Request Forgery (SSRF) in Anthropic mcp-server-fetch and Microsoft playwright-mcp

Author: Syed Anas Mohiuddin <anasmohiuddinsyed () gmail com>

Date: May 25, 2026

CVSS: 7.5 (HIGH) — AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References: Already public via GitHub issues (see below)

== AFFECTED PRODUCTS ==

Anthropic mcp-server-fetch (modelcontextprotocol/servers)

All versions as of May...

No data

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
Full Disclosure	full_disc	threat_intel		-	de	https://seclists.org/rss/fulldisclosure.rss