CVE-2026-108583 in Zotero MCP
Summary
by MITRE • 10/10/2026
zotero-mcp 0.10.0 through 0.14.1 contains a server-side request forgery vulnerability that allows attackers to reach internal services because _fetch_embedded_metadata fetches URLs without destination validation. Attackers can steer the agent via prompt injection into calling zotero_add_by_url, causing requests to loopback, private, or link-local hosts directly or via redirects, leaking citation meta-tags and error details.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/10/2026
The vulnerability identified in Zotero MCP versions 0.10.0 through 0.14.1 represents a critical server-side request forgery flaw rooted in the improper validation of user-supplied input within the _fetch_embedded_metadata function. This component is responsible for retrieving metadata from external URLs to enrich citation data, but it fails to implement strict destination validation or allow-listing mechanisms before initiating network requests. Consequently, an attacker who can influence the URL parameter passed to this function can direct the server to fetch resources from arbitrary destinations rather than solely public internet addresses. The absence of checks against loopback interfaces, private internal networks, and link-local addresses creates a significant attack surface that undermines the isolation between the application server and the underlying network infrastructure.
The operational impact of this vulnerability is exacerbated by its interaction with prompt injection techniques within the AI agent framework. Attackers can craft malicious prompts designed to trick the language model into invoking the zotero_add_by_url function with carefully constructed URLs. These URLs may point directly to internal services or utilize HTTP redirects to bypass initial filtering, effectively allowing the attacker to pivot through the server's network stack. This capability enables unauthorized access to sensitive internal resources that are not intended for public exposure. The vulnerability facilitates data exfiltration by causing the server to retrieve and potentially expose citation meta-tags and detailed error messages from these internal endpoints. Such information leakage can reveal architectural details, service versions, or confidential document contents stored within the organization's private network.
From a classification perspective, this issue aligns with CWE-918 Server-Side Request Forgery (SSRF), specifically involving insufficient validation of user-controlled input before making server-side requests. The attack vector leverages prompt injection to manipulate the AI agent's behavior, which corresponds to MITRE ATT&CK technique T1505.003 Web Services or potentially T1621 Forceful Boolean Expression Evaluation if the logic bypasses are complex, though primarily it falls under input validation failures leading to SSRF. The exploitation path involves both social engineering aspects via prompt injection and technical execution of network requests from a privileged server context.
Mitigation strategies must focus on implementing strict allow-listing for outbound connections initiated by the _fetch_embedded_metadata function. Developers should restrict URL schemes to only those necessary, such as HTTP and HTTPS, while explicitly blocking access to loopback addresses like 127.0.0.1 or ::1, private IP ranges defined in RFC 1918, link-local addresses, and cloud metadata endpoints commonly targeted by SSRF attacks. Additionally, implementing a network-level proxy that filters outbound traffic based on destination can provide an additional layer of defense independent of application logic. For users currently running affected versions, upgrading to the latest patched release is essential to resolve this security deficiency. Until patching is feasible, restricting user input capabilities within the AI agent interface and disabling external URL fetching features where not strictly required can reduce exposure to this vulnerability.