CVE-2026-10280 in mcpilot
Summary
by MITRE • 06/01/2026
A security flaw has been discovered in horizon921 mcpilot 0.1.0. The impacted element is an unknown function of the file client/src/app/api/mcp/call/route.ts of the component MCP API Call Endpoint. The manipulation of the argument serverBaseUrl results in server-side request forgery. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 06/04/2026
The vulnerability identified in horizon921 mcpilot 0.1.0 represents a critical server-side request forgery flaw that resides within the MCP API Call Endpoint component. This security weakness manifests in the client/src/app/api/mcp/call/route.ts file where an unknown function processes the serverBaseUrl argument, creating an avenue for malicious actors to manipulate the application's behavior. The vulnerability's classification as server-side request forgery aligns with CWE-918, which specifically addresses server-side request forgery attacks that enable attackers to make requests on behalf of the server. The attack vector is remotely exploitable, meaning that adversaries can initiate the attack from external networks without requiring physical access to the system. This remote exploitability significantly increases the attack surface and potential impact of the vulnerability.
The technical implementation of this flaw demonstrates a dangerous lack of input validation and sanitization within the serverBaseUrl parameter processing. When an attacker supplies malicious input to this parameter, the application fails to properly validate or sanitize the provided URL, allowing arbitrary server requests to be executed. The vulnerability's exploitation capability has been made public through released exploit code, which means that threat actors can readily leverage this weakness without requiring advanced technical skills. The fact that the project maintainers were informed through an issue report but have not responded indicates a potential delay in vulnerability remediation that leaves the system exposed to active exploitation attempts.
The operational impact of this vulnerability extends beyond simple data exfiltration or service disruption, as it can enable attackers to perform unauthorized operations against internal systems that the server can access. This includes potential access to internal APIs, databases, or other backend services that may not be directly exposed to the internet. The vulnerability's presence in the MCP API Call Endpoint component suggests that it could be leveraged to escalate privileges or gain deeper access to the application's functionality. According to ATT&CK framework's T1190 technique, this vulnerability provides an entry point for attackers to conduct reconnaissance and lateral movement within the network infrastructure. The lack of response from the project maintainers creates a window of opportunity for attackers to exploit this weakness before proper remediation can be implemented.
Mitigation strategies for this vulnerability should prioritize immediate implementation of input validation and sanitization measures for the serverBaseUrl parameter. The code should enforce strict URL validation using allowlists of trusted domains and reject any input that does not conform to expected patterns. Additionally, implementing proper network segmentation and firewall rules can help limit the potential impact of successful exploitation attempts. The application should also be configured with appropriate access controls to restrict the scope of operations that can be performed through the API endpoint. Organizations should consider implementing monitoring and logging mechanisms to detect suspicious API usage patterns that may indicate exploitation attempts. The vulnerability's public exploit availability necessitates immediate action to patch or mitigate the issue before it can be leveraged by malicious actors in the wild.