Description
A vulnerability was identified in graphlit graphlit-mcp-server 1.0.1. This affects the function fetch of the file src/tools.ts of the component ssrf-test Endpoint. Such manipulation of the argument url leads to server-side request forgery. The attack may be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-08-16
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A server‑side request forgery (SSRF) flaw exists in the fetch function of the ssrf-test endpoint of graphlit‑mcp‑server 1.0.1, allowing an attacker to control the destination URL that the server subsequently requests. This manipulation can lead to the server accessing internal network resources, exposing sensitive data or providing a foothold for further attacks. The vulnerability is formally classified as CWE‑918, indicating a failure of input validation around URL handling.

Affected Systems

The affected product is graphlit‑mcp‑server released under the graphlit:graphlit‑mcp‑server CPE. Only the 1.0.1 version, as specified in the advisory, is vulnerable; no other releases or vendor variants are listed.

Risk and Exploitability

The CVSS score of 5.3 reflects a moderate risk, and the EPSS score is not available, implying no current data on exploitation prevalence. The vulnerability is not listed in CISA’s KEV catalog, but the advisory notes that an exploit is publicly available and could be used remotely against unattended installations.

Generated by OpenCVE AI on August 16, 2026 at 23:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Deploy the latest graphlit‑mcp‑server release when one becomes available
  • If a patched version is not yet released, block outbound traffic from the ssrf‑test endpoint to internal networks using firewall rules or a reverse‑proxy blacklist
  • Implement strict URL validation by rejecting malformed or disallowed hostnames and only permitting whitelisted domains for outbound requests
  • Monitor application logs for unexpected outbound HTTP requests that may indicate SSRF exploitation attempts

Generated by OpenCVE AI on August 16, 2026 at 23:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 16 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in graphlit graphlit-mcp-server 1.0.1. This affects the function fetch of the file src/tools.ts of the component ssrf-test Endpoint. Such manipulation of the argument url leads to server-side request forgery. The attack may be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Title graphlit graphlit-mcp-server ssrf-test Endpoint tools.ts fetch server-side request forgery
First Time appeared Graphlit
Graphlit graphlit-mcp-server
Weaknesses CWE-918
CPEs cpe:2.3:a:graphlit:graphlit-mcp-server:*:*:*:*:*:*:*:*
Vendors & Products Graphlit
Graphlit graphlit-mcp-server
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Graphlit Graphlit-mcp-server
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-16T22:00:12.167Z

Reserved: 2026-08-16T06:27:20.695Z

Link: CVE-2026-19957

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-16T22:16:28.970

Modified: 2026-08-16T22:16:28.970

Link: CVE-2026-19957

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-16T23:30:12Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)