# @cardano402/mcp-server missing spending limits and SSRF via catalog

Source: https://junglewise.ai/threats/cardano402-mcp-server-missing-spending-limits-and-ssrf-via-catalog-bf8d8353  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: low · CVSS 3.1 · Published 2026-06-26

@cardano402/mcp-server is an npm package that exposes Cardano blockchain payment tools through an MCP (Model Context Protocol) interface, allowing Large Language Models to initiate cryptocurrency transactions. The package in versions 0.1.1 and earlier lacks spending limits on signed transactions, exposes an unauthenticated HTTP endpoint accessible across a LAN, and accepts malicious catalog URLs that can trigger Server-Side Request Forgery attacks against internal infrastructure. An attacker could drain a user's cryptocurrency wallet, intercept LAN-based payment requests, or access sensitive internal systems.

Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 3.1, published 26 June 2026.

**Which products and versions are affected?** @cardano402/mcp-server (npm) SEMVER:introduced=0,fixed=0.1.2.

**Is there a fix for This vulnerability?** Yes. @cardano402/mcp-server (npm): upgrade to 0.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network or from the adjacent network, in a software library.

**Am I affected?** Check whether you run @cardano402/mcp-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @cardano402/mcp-server (npm): upgrade to 0.1.2 or later

  ```sh
  npm install @cardano402/mcp-server@0.1.2
  ```


## Technical details

The package contains three distinct vulnerabilities: (1) Missing spending controls—LLMs can repeatedly invoke payment tools without per-call caps, daily limits, recipient allowlists, or confirmation steps, allowing wallet drain via prompt injection; (2) Unauthenticated LAN exposure—the HTTP transport binds to 0.0.0.0 without authentication, Origin validation, or bearer-token checks, enabling any LAN peer to invoke MCP tools; (3) Server-Side Request Forgery via catalog.server.url—the allowInsecure validation only checks the catalog URL itself, not the server.url returned by a malicious catalog, and endpoint.path traversal is not normalized, permitting attacks on RFC1918 private networks (e.g., AWS metadata). Attack vectors are network-reachable (LAN or Internet via catalog compromise) and require no authentication for LAN-bound HTTP mode. Fix available in version 0.1.2 adds per-call/daily spending limits, loopback-default HTTP binding, bearer-token enforcement, CIDR-based server.url validation, and path traversal protection.

## Affected products

- MorganOnCode mcp-server <= 0.1.1

## Timeline

- 2026-06-26: disclosed
- 2026-06-26: patched: Fixed in @cardano402/mcp-server@0.1.2

## References

- [https://github.com/MorganOnCode/cardano402/security/advisories/GHSA-rp72-5v5q-2446](https://github.com/MorganOnCode/cardano402/security/advisories/GHSA-rp72-5v5q-2446)
- [https://github.com/MorganOnCode/cardano402](https://github.com/MorganOnCode/cardano402)