Description
A flaw has been found in MissionSquad mcp-api up to 1.11.9. The affected element is an unknown function of the file src/services/dcrClients.ts. Executing a manipulation can lead to server-side request forgery. The attack may be performed from remote. Upgrading to version 1.11.10 is sufficient to fix this issue. This patch is called f068ab4ad6f0907ac7001b995588c2673f11a755. You should upgrade the affected component.
Published: 2026-08-06
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability exists in an unknown function within dcrClients.ts of MissionSquad mcp-api. It allows an attacker to abuse a server‑side request forgery (SSRF) flaw, enabling the remote execution of arbitrary outbound requests from the server. The flaw is categorized as CWE-918 and can be triggered from remote without special credentials.

Affected Systems

Affected deployments run MissionSquad mcp‑api up to and including version 1.11.9. The patch noted as f068ab4ad6f0907ac7001b995588c2673f11a755 was released in version 1.11.10, removing the vulnerable function. All other versions after 1.11.10 are considered safe.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate impact, though the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote and does not require authentication according to the description. While the potential for internal network reconnaissance or service discovery exists, the lack of additional details makes exploitation effort moderate.

Generated by OpenCVE AI on August 6, 2026 at 16:28 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade MissionSquad mcp‑api to version 1.11.10 or later to eliminate the SSRF flaw.
  • If upgrading is not immediately possible, apply the specific patch commit f068ab4ad6f0907ac7001b995588c2673f11a755 from the repository to mitigate the vulnerability.
  • Implement network segmentation or firewall rules that restrict outbound traffic from the mcp‑api service to only approved destinations, reducing the impact of any potential SSRF exploitation.

Generated by OpenCVE AI on August 6, 2026 at 16:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 06 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 06 Aug 2026 14:00:00 +0000

Type Values Removed Values Added
Description A flaw has been found in MissionSquad mcp-api up to 1.11.9. The affected element is an unknown function of the file src/services/dcrClients.ts. Executing a manipulation can lead to server-side request forgery. The attack may be performed from remote. Upgrading to version 1.11.10 is sufficient to fix this issue. This patch is called f068ab4ad6f0907ac7001b995588c2673f11a755. You should upgrade the affected component.
Title MissionSquad mcp-api dcrClients.ts server-side request forgery
First Time appeared Missionsquad
Missionsquad mcp-api
Weaknesses CWE-918
CPEs cpe:2.3:a:missionsquad:mcp-api:*:*:*:*:*:*:*:*
Vendors & Products Missionsquad
Missionsquad mcp-api
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Missionsquad Mcp-api
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-06T15:05:57.661Z

Reserved: 2026-08-06T06:01:41.090Z

Link: CVE-2026-19040

cve-icon Vulnrichment

Updated: 2026-08-06T15:05:52.503Z

cve-icon NVD

Status : Deferred

Published: 2026-08-06T14:16:36.043

Modified: 2026-08-12T21:00:37.147

Link: CVE-2026-19040

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-06T18:45:17Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)