CVE-2026-19770 in fm-mcp-servers
Summary
by MITRE • 08/14/2026
A vulnerability was identified in feedmob fm-mcp-servers 0.0.3. Affected by this vulnerability is the function downloadReport of the file src/smadex-reporting/src/index.ts of the component Download Endpoint. The manipulation of the argument downloadUrl leads to server-side request forgery. The attack can only be performed from a local environment. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/14/2026
This vulnerability exists within the feedmob fm-mcp-servers 0.0.3 software component where the downloadReport function in src/smadex-reporting/src/index.ts file contains a server-side request forgery flaw. The specific technical weakness occurs when the downloadUrl argument is manipulated, allowing an attacker to potentially redirect requests to unintended destinations. This represents a classic ssrf vulnerability that falls under CWE-918 which specifically addresses server-side request forgery attacks where applications fetch resources from untrusted sources without proper validation.
The operational impact of this vulnerability is significant despite its restriction to local environment exploitation. While the attack vector requires local system access, this limitation does not diminish the potential damage as attackers with local privileges can leverage this flaw to bypass network restrictions and access internal systems or services that would normally be protected from external access. The fact that the exploit is publicly available increases the risk profile considerably since it reduces the barrier to exploitation for threat actors who may have gained local access through other means.
The vulnerability's context reveals a concerning pattern of delayed response from the project maintainers, as they were informed through an issue report but have not yet addressed the problem. This delay creates an extended window of exposure where potentially malicious actors can exploit the known vulnerability without risk of immediate patching. The combination of public exploit availability and lack of response demonstrates poor security hygiene and inadequate incident response procedures that could leave users vulnerable to exploitation.
Security professionals should consider this vulnerability in relation to ATT&CK technique T1071.004 which covers application layer protocol tunneling, where attackers may use similar mechanisms to bypass network controls. Organizations using this software should implement immediate mitigations including input validation for the downloadUrl parameter, network segmentation to limit local access, and monitoring for suspicious request patterns that might indicate exploitation attempts.
The remediation approach should involve proper sanitization and validation of URL inputs to prevent arbitrary redirections, implementing strict whitelisting of allowed domains or IP addresses, and potentially removing or restricting the downloadReport functionality if it's not essential for core operations. Additionally, the project maintainers should be urged to establish proper vulnerability disclosure and patching procedures to prevent similar issues from accumulating in their software supply chain.
This vulnerability demonstrates how seemingly limited attack surface can still pose significant risks when combined with public exploit availability and delayed response times. The local exploitation requirement does not provide adequate protection against determined attackers who may have already gained system access through other means, making this a critical issue requiring immediate attention to prevent potential compromise of internal systems that might be accessible through the vulnerable server-side component.
The presence of an unpatched ssrf vulnerability in a widely used software package creates cascading security risks as organizations may unknowingly expose their infrastructure to attacks that could potentially escalate beyond the initial compromised system. Security teams should prioritize this vulnerability for immediate remediation while also conducting broader assessments to identify any other similar issues within their software dependencies and supply chain components.