CVE-2026-108787 in voice-analyser-mcp
Summary
by MITRE • 10/12/2026
A vulnerability was found in houtini-ai voice-analyser-mcp up to 2.1.1. The affected element is the function fetch of the file src/utils/crawler.ts of the component collect_corpus. Performing a manipulation of the argument sitemap_url results in server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in houtini-ai voice-analyser-mcp, specifically within version 2.1.1, represents a critical server-side request forgery flaw located in the fetch function of the src/utils/crawler.ts file under the collect_corpus component. This security defect arises from improper validation and sanitization of user-supplied input, particularly when handling the sitemap_url argument. When an attacker provides a maliciously crafted URL as part of this parameter, the application fails to restrict or verify the destination address before initiating an HTTP request. Consequently, the server processes the request on behalf of the client, allowing the attacker to direct internal network traffic to arbitrary external or internal endpoints. This behavior is characteristic of CWE-918, which defines Server-Side Request Forgery as a vulnerability where a web application fetches a remote resource without validating the user-supplied URL, potentially leading to severe security breaches including access to sensitive data behind firewalls and bypassing authentication mechanisms.
The operational impact of this vulnerability is significant due to its potential for remote exploitation. Since the flaw resides in a crawler component likely designed to process external inputs such as sitemaps or content feeds, it presents an attractive attack vector for adversaries seeking to probe internal network infrastructure. By leveraging SSRF, an attacker can potentially access cloud metadata services like AWS EC2 instance metadata, which often contain temporary credentials and configuration details that could lead to full account compromise. Furthermore, the vulnerability enables attackers to perform port scanning of internal hosts, interact with local administrative interfaces such as Kubernetes API servers or database management consoles, and exfiltrate sensitive data from resources that are not directly exposed to the public internet but are accessible via the server's network interface. The fact that an exploit has been made public increases the risk landscape considerably, as it lowers the barrier for entry for less sophisticated threat actors who can utilize existing proof-of-concept code to launch attacks against unpatched instances of houtini-ai voice-analyser-mcp.
From a tactical perspective, this vulnerability aligns with several techniques outlined in the MITRE ATT&CK framework. Specifically, it relates to T1598, which covers Phishing for Information or Service, as SSRF is often chained after initial access vectors like phishing emails containing malicious links that trigger server-side requests. It also maps directly to T1046, Network Service Discovery, where the attacker uses the compromised server to map out internal network services and identify potential targets for further exploitation. The lack of response from the vendor since early contact suggests a gap in their security disclosure process, leaving users without official patches or guidance on remediation timelines. This situation underscores the importance of proactive vulnerability management and the need for organizations relying on this software to implement compensating controls immediately rather than waiting for an upstream fix.
To mitigate the risks associated with this SSRF vulnerability, immediate action is required at both the application configuration and network architecture levels. At the application layer, developers must enforce strict allow-listing of permitted domains or IP addresses that the crawler component is authorized to access, ensuring that any input not matching these criteria is rejected before being passed to the fetch function. Implementing robust URL parsing logic to detect and block redirects to private IP ranges, such as 10.x.x.x, 172.16-31.x.x, and 192.168.x.x, is essential for preventing access to internal resources. Additionally, disabling HTTP redirects within the fetch implementation can prevent attackers from bypassing initial validation by redirecting requests to allowed domains that subsequently point back to restricted targets. From a network perspective, deploying web application firewalls with SSRF detection capabilities and configuring egress filtering rules on cloud instances or servers running this software can restrict outbound connections to only those necessary for legitimate operations, thereby limiting the blast radius of any successful exploitation attempt.