The vulnerability occurs in src/core/CrawlOrchestrator.ts of the Crawler component, where an unauthenticated user can supply crafted input to the run_seo_audit function, causing the application server to issue HTTP requests to arbitrary URLs. This behavior aligns with CWE‑918 and enables a server‑side request forgery. While the description does not mention additional privilege escalation, the primary impact is that a remote attacker can make the server contact internal or external resources and potentially access sensitive information. Based on the information, the likely attack vector is a remote exploitation through the exposed function.

The affected product is houtini‑ai seo‑crawler‑mcp, with all releases up to version 2.1.5 considered vulnerable. No details on newer releases are provided, so any instance running 2.1.5 or earlier remains at risk. The vulnerable code resides in the CrawlOrchestrator.ts file within the Crawler module used for SEO auditing.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the public disclosure and demonstrated ability to trigger outbound requests suggests a non‑zero risk of abuse. An attacker could use the SSRF flaw to reach internal networks or external services, potentially facilitating further compromise. Administrators should treat this as a moderate risk while monitoring for suspicious outbound activity until a patch becomes available.