Description
A security flaw has been discovered in aliyun alibabacloud-dataworks-mcp-server up to 1.0.43. The impacted element is the function ReadResourceRequestSchema of the file src/resources/initResources.ts. The manipulation of the argument request.params.uri results in server-side request forgery. The attack may be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-08-09
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the ReadResourceRequestSchema function within initResources.ts. Manipulation of the request.params.uri argument allows an attacker to cause the server to send HTTP requests to arbitrary internal or external resources. As a result, an attacker could exfiltrate sensitive data, bypass authentication, or potentially exploit downstream services. The weakness corresponds to CWE‑918.

Affected Systems

The affected component is Alibaba Cloud DataWorks MCP Server up to version 1.0.43. Any deployment of this product using the stated version range is potentially vulnerable.

Risk and Exploitability

The CVSS base score of 5.3 indicates moderate risk. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The description states that the attack can be launched remotely, meaning a threat actor only needs network access to the exposed API endpoint. Given the lack of an official patch at present, the risk persists until a fix or mitigation is applied.

Generated by OpenCVE AI on August 9, 2026 at 07:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to a version later than 1.0.43 once a vendor fix is released.
  • If an immediate upgrade is not feasible, isolate the server from untrusted outbound traffic by configuring firewall rules or network segmentation to restrict SSRF attempts.
  • Implement application‑level URL validation to reject or whitelist approved destinations before forwarding requests.
  • Contact Alibaba Cloud support to obtain guidance on interim controls or an accelerated patch release.

Generated by OpenCVE AI on August 9, 2026 at 07:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 09 Aug 2026 06:45:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in aliyun alibabacloud-dataworks-mcp-server up to 1.0.43. The impacted element is the function ReadResourceRequestSchema of the file src/resources/initResources.ts. The manipulation of the argument request.params.uri results in server-side request forgery. The attack may be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.
Title aliyun alibabacloud-dataworks-mcp-server initResources.ts ReadResourceRequestSchema server-side request forgery
First Time appeared Aliyun
Aliyun alibabacloud-dataworks-mcp-server
Weaknesses CWE-918
CPEs cpe:2.3:a:aliyun:alibabacloud-dataworks-mcp-server:*:*:*:*:*:*:*:*
Vendors & Products Aliyun
Aliyun alibabacloud-dataworks-mcp-server
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Aliyun Alibabacloud-dataworks-mcp-server
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-09T06:30:09.439Z

Reserved: 2026-08-08T11:31:43.564Z

Link: CVE-2026-19339

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-09T07:30:04Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)