Executive brief
swagger-testcase-mcp is an MCP (Model Context Protocol) server that generates test cases and validates API specifications from Swagger/OpenAPI schemas. A server-side request forgery vulnerability allows attackers to manipulate the tool to make HTTP requests to arbitrary destinations—including internal services, cloud metadata endpoints, or attacker-controlled servers—potentially exfiltrating credentials or internal data.
Technical details
The vulnerability is a server-side request forgery (SSRF) in the loadSource() function (src/utils/swagger-parser.ts) that affects multiple tools including fetch_swagger, compare_specs, validate_spec, and suggest_missing_tests. The root cause is that the source parameter is validated only as a generic string (z.string()) without URL format validation or destination allowlisting, then passed directly to fetch(). Because there is no hostname/IP range validation, port restrictions, or redirect filtering, an attacker can supply arbitrary URLs including loopback addresses (127.0.0.1), private network ranges, or cloud metadata endpoints. Optional auth_header and headers parameters are forwarded into the outbound request, enabling credential exfiltration. An attacker can inject malicious source parameters through prompt injection or MCP client hijacking to trigger outbound requests from the server's network context. No patch has been released; the project has not responded to the issue report.
Affected products
- eyaushev swagger-testcase-mcp 1.0.0 (rolling release; all versions potentially affected)
Timeline
- 2026-06-25: disclosed: Issue reported on GitHub
- 2026-08-14: advisory: Published to NVD as CVE-2026-19765