Executive brief
mcp-dominican-layer is an MCP server that provides access to Dominican Congress legislative information and includes a PDF parsing tool. The tool accepts a URL parameter without properly validating the destination, allowing attackers to forge requests to arbitrary internal or external systems (SSRF). An attacker can exploit this to access private network services, internal APIs, or metadata endpoints without authorization.
Technical details
The vulnerability is a server-side request forgery (SSRF) in the parse-pdf tool located in src/index.ts. The root cause is insufficient validation of the pdfUrl parameter: while the code uses Zod's z.string().url() to check basic URL format, it performs no destination allowlisting, IP range validation, or hostname restrictions before passing the URL directly to axios.get(). An attacker can manipulate the pdfUrl parameter to trigger outbound requests to localhost, private network ranges, link-local addresses, or cloud metadata endpoints. The attack is remotely exploitable with no authentication required, and the full HTTP response body is returned to the caller (full-read SSRF). The vulnerability has been publicly disclosed via GitHub issue and exploit code is available; the vendor has not yet responded to the report.
Affected products
- EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82
Timeline
- 2026-06-25: disclosed: Vulnerability reported via GitHub issue #3
- 2026-08-13: disclosed: CVE-2026-19752 published on NVD