Description
A weakness has been identified in anubissbe ProjectHub-Mcp up to 5.0.0. This affects an unknown function of the file backend-fix/complete_backend.js of the component Webhooks API. This manipulation of the argument url causes server-side request forgery. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-08-09
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A weakness was discovered in the Webhooks API of anubissbe ProjectHub‑Mcp that allows an attacker to manipulate the URL argument in the backend-fix/complete_backend.js file, leading to a server‑side request forgery (SSRF). This flaw permits a remote actor to trigger internal HTTP requests from the affected server, potentially exposing internal resources, exfiltrating data, or pivoting within a network. The vulnerability is classified as a moderate severity issue with a CVSS score of 5.3, and it does not compromise code execution but can be used for malicious outbound communications.

Affected Systems

The problem exists in all versions of anubissbe ProjectHub‑Mcp up to and including 5.0.0. Any deployment of this product that includes the Webhooks API component is affected; the specific file impacted is backend-fix/complete_backend.js. No other products or vendors are listed as affected.

Risk and Exploitability

The CVSS score signals a medium risk and the AE probability is unknown as EPSS data is not available. The flaw is not listed in the CISA KEV catalog. Attackers can exploit this vulnerability remotely by sending a crafted request to the Webhooks API that contains a malicious URL parameter; no local privilege or advanced access prerequisites are documented. The impact is limited to the server's outbound network interactions but can lead to compromise of internal services.

Generated by OpenCVE AI on August 9, 2026 at 08:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Verify if the deployed ProjectHub‑Mcp version is 5.0.0 or earlier and, if so, upgrade to the latest patched release once it becomes available
  • Configure your network boundaries so that the Webhooks API is only allowed to initiate outbound connections to trusted destinations; use firewall or proxy rules to block unintended external traffic
  • Modify the complete_backend.js handler to strictly validate or whitelist acceptable URL values, rejecting any requests that attempt to access internal or disallowed resources
  • Consider enabling monitoring of outbound HTTP traffic from the Webhooks service to detect anomalous or suspicious requests

Generated by OpenCVE AI on August 9, 2026 at 08:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 09 Aug 2026 07:15:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in anubissbe ProjectHub-Mcp up to 5.0.0. This affects an unknown function of the file backend-fix/complete_backend.js of the component Webhooks API. This manipulation of the argument url causes server-side request forgery. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.
Title anubissbe ProjectHub-Mcp Webhooks API complete_backend.js server-side request forgery
First Time appeared Anubissbe
Anubissbe projecthub-mcp
Weaknesses CWE-918
CPEs cpe:2.3:a:anubissbe:projecthub-mcp:*:*:*:*:*:*:*:*
Vendors & Products Anubissbe
Anubissbe projecthub-mcp
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Anubissbe Projecthub-mcp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-09T06:45:09.171Z

Reserved: 2026-08-08T11:31:48.374Z

Link: CVE-2026-19340

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-09T08:30:17Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)