The vulnerability resides in the MCP tool's handling of the server_url parameter passed to the OpenAI‑compatible POST /v1/responses endpoint. The server fetches the URL without validating that it is not private, unlike other URL inputs validated by validate_url_not_private(). Consequently, an attacker can supply a server_url pointing to any internal or cloud metadata endpoint, and the server will connect to it, potentially leaking request headers and bearer tokens. This can enable remote access to internal services or credentials, representing a serious SSRF flaw with high impact.

ogx, the open‑source AI stack from ogx-ai, is affected in version 1.3.1. Users running this default version with the starter configuration, which has no authentication enabled, are at risk. Any deployment that imports MCP tool definitions with a server_url parameter while running unprotected is vulnerable.

The CVSS score of 8.7 classifies this as a high‑severity vulnerability. The lack of authentication on the endpoint and the absence of URL validation make exploitation straightforward for an unauthenticated remote actor. Since EPSS data is not available, the exploitation likelihood cannot be quantified, but the known attack surface suggests a non‑negligible risk. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed exploit in the wild yet, but the conditions for exploitation are met in a typical default setup, warranting urgent attention.