Description
A vulnerability was detected in Model Context Protocol mcp-rdf-explorer 1.0.0. Affected is the function explore_url of the file src/mcp-rdf-explorer/server.py of the component MCP Server. Performing a manipulation of the argument url results in server-side request forgery. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-08-13
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A server-side request forgery issue exists in the explore_url function of Model Context Protocol mcp-rdf-explorer 1.0.0. Because the URL parameter is manipulated without proper validation, an attacker can force the server to perform arbitrary HTTP requests. This flaw can lead to data leakage, unauthorized access to internal resources, and potentially the execution of malicious code on the victim machine. The vulnerability is classified as CWE-918.

Affected Systems

The affected product is Model Context Protocol mcp-rdf-explorer version 1.0.0. No other versions or products are currently identified as impacted.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, but the exploit is public and can be triggered remotely. Attackers can exploit the flaw by sending a crafted request to the server’s explore_url endpoint, causing the server to resolve and fetch the specified URL, thus accessing internal or external resources on behalf of the server.

Generated by OpenCVE AI on August 14, 2026 at 00:03 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any available vendor patch for mcp-rdf-explorer if one has been released.
  • Configure the network firewall or router to block outbound HTTP/S traffic from the MCP Server except to a predefined, trusted list of domains necessary for normal operations.
  • Modify the server code or deployment configuration to validate the URL parameter, allowing only whitelisted hosts and schemes and rejecting any other input.

Generated by OpenCVE AI on August 14, 2026 at 00:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 14 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 13 Aug 2026 22:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in Model Context Protocol mcp-rdf-explorer 1.0.0. Affected is the function explore_url of the file src/mcp-rdf-explorer/server.py of the component MCP Server. Performing a manipulation of the argument url results in server-side request forgery. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Model Context Protocol mcp-rdf-explorer MCP Server server.py explore_url server-side request forgery
First Time appeared Model Context Protocol
Model Context Protocol mcp-rdf-explorer
Weaknesses CWE-918
CPEs cpe:2.3:a:model_context_protocol:mcp-rdf-explorer:*:*:*:*:*:*:*:*
Vendors & Products Model Context Protocol
Model Context Protocol mcp-rdf-explorer
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Model Context Protocol Mcp-rdf-explorer
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-14T15:54:55.170Z

Reserved: 2026-08-13T15:12:52.542Z

Link: CVE-2026-19753

cve-icon Vulnrichment

Updated: 2026-08-14T15:54:44.745Z

cve-icon NVD

Status : Deferred

Published: 2026-08-13T23:17:14.440

Modified: 2026-08-14T19:09:39.140

Link: CVE-2026-19753

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-14T09:30:01Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)