CVE-2026-19984 in mcp-florence2
Summary
by MITRE • 08/17/2026
A flaw has been found in jkawamoto mcp-florence2 up to 0.3.13. Affected by this issue is the function get_images of the file src/mcp_florence2/__init__.py. This manipulation of the argument src causes server-side request forgery. The attack may be initiated remotely. The exploit has been published and may be used. It is recommended to change the configuration settings. The vendor explains: "For deployments where SSRF protection is required, I recommend routing all HTTP(S) requests through an SSRF-safe proxy server. This approach mitigates the vulnerability without requiring changes to the mcp-florence2 source code."
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
The identified vulnerability in jkawamoto mcp-florence2 versions up to 0.3.13 represents a critical security flaw within the get_images function located in src/mcp_florence2/_init_.py. This issue is classified as Server-Side Request Forgery, commonly referred to by its acronym SSRF. The root cause lies in improper validation of user-supplied input passed through the src argument. When an attacker provides a maliciously crafted URL or file path instead of a legitimate image source, the application processes this input without adequate sanitization or restriction checks. This allows the server-side component to initiate HTTP requests on behalf of the victim system to arbitrary destinations controlled by the attacker. The vulnerability is remotely exploitable, meaning that no local access or authentication is necessarily required for an adversary to trigger the flaw over a network connection.
The operational impact of this SSRF vulnerability extends beyond simple data exfiltration from internal services. By leveraging the server's own outbound connectivity capabilities, attackers can probe and interact with internal infrastructure components that are typically isolated from external networks. This includes accessing cloud metadata endpoints such as those found in AWS EC2 or Azure Managed Identity environments to steal credentials and escalate privileges within a compromised environment. Furthermore, the attacker may target internal web applications, database management interfaces, or administrative panels running on localhost or private subnets. Since an exploit has already been published, automated attacks against systems running vulnerable versions of mcp-florence2 are likely occurring in the wild, posing immediate risk to any deployment that processes untrusted image sources without additional protective layers.
From a classification perspective, this vulnerability aligns with CWE-918, which defines Server-Side Request Forgery flaws where software makes requests from a server but does not sufficiently validate user-supplied input. It also maps to MITRE ATT&CK technique T1571, specifically the Non-Standard Port or Protocol sub-category if used for evasion, and generally falls under Initial Access techniques that leverage trusted services to bypass perimeter defenses. The ability to initiate requests from a privileged server position makes this particularly dangerous in cloud-native architectures where internal service discovery relies on predictable network paths.
To mitigate this risk without modifying the source code of mcp-florence2, it is strongly recommended to implement an architectural defense-in-depth strategy centered around proxying all HTTP and HTTPS traffic through an SSRF-safe proxy server. This intermediary layer should enforce strict allow-lists for outbound connections, restricting them only to known and trusted domains or IP ranges required by the application logic. The proxy must also be configured to reject requests targeting private IP address ranges such as 10.x.x.x, 172.16-31.x.x, and 192.168.x.x, as well as loopback addresses like 127.0.0.1 and link-local scopes. Additionally, administrators should disable HTTP redirects at the proxy level to prevent attackers from bypassing initial restrictions by chaining multiple requests that redirect to internal targets. Regular auditing of outbound network traffic and updating dependency versions when patches are released remain essential practices for maintaining long-term security posture against evolving SSRF attack vectors.