Is CVE-2026-15750 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15750 being exploited in the wild.

How severe is CVE-2026-15750?

Medium severity, with a CVSS score of 6.3, published 14 July 2026.

Which products and versions are affected?

MasterGo Magic-Mcp up to 0.2.0.

Is there a fix for CVE-2026-15750?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15750 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-15750?

Check whether you run MasterGo Magic-Mcp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15750: MasterGo Magic MCP SSRF in mcp__getComponentLink

CVE-2026-15750 · Severity: medium · CVSS 6.3 · Published 2026-07-14

MasterGo Magic MCP is a tool used to connect MasterGo design software with AI models. A security flaw allows an attacker to trick the server into making unauthorized web requests to internal systems or cloud metadata services. This could lead to the exposure of sensitive internal data, such as cloud credentials or private administrative interfaces, which are normally protected from the public internet.

Technologies: MasterGo Magic-Mcp. Vendors: MasterGo.

Quick answers

Is CVE-2026-15750 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15750 being exploited in the wild.
How severe is CVE-2026-15750?: Medium severity, with a CVSS score of 6.3, published 14 July 2026.
Which products and versions are affected?: MasterGo Magic-Mcp up to 0.2.0.
Is there a fix for CVE-2026-15750?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15750 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-15750?: Check whether you run MasterGo Magic-Mcp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the `mcp__getComponentLink` tool within `src/tools/get-component-link.ts`. The `url` argument is validated only as a generic string via `z.string()` and is passed directly to an HTTP GET request without scheme or hostname restrictions. An attacker can provide arbitrary URLs, including those for local services (localhost) or cloud metadata endpoints (e.g., 169.254.169.254), and receive the full response body. This is a non-blind SSRF primitive that can be triggered by any MCP client or prompt-injected agent. As of the advisory date, the project has not released a patch.

Affected products

mastergo-design mastergo-magic-mcp up to 0.2.0

Timeline

2026-05-29: disclosed: Vulnerability reported to the vendor via GitHub issue.
2026-07-14: advisory: CVE-2026-15750 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.