Executive brief
mcp-florence2 is an image processing server that integrates with AI assistants like Claude and Cursor to perform OCR and image captioning tasks. A server-side request forgery (SSRF) vulnerability in the image-fetching functionality allows attackers to make the server issue arbitrary HTTP requests to internal networks, cloud metadata endpoints, or other hosts reachable from the server process—potentially exposing sensitive internal resources or configurations.
Technical details
The vulnerability is a server-side request forgery (SSRF) in the get_images() function in src/mcp_florence2/__init__.py. When users supply a URL starting with http:// or https:// to the ocr or caption tools, the function passes the URL directly to requests.get() without validating the destination host, IP range, or any other safeguards. An attacker can craft malicious src parameters pointing to internal network services, cloud metadata endpoints (e.g., 169.254.169.254), or other restricted hosts. No authentication is required; the vulnerability is network-reachable to any caller of the MCP interface. An attacker can enumerate internal services, exfiltrate sensitive data from internal endpoints, or probe network topology. The vendor recommends routing all HTTP(S) requests through an SSRF-safe proxy as a mitigation; a formal patch addressing host validation is not explicitly mentioned in the advisory.
Affected products
- jkawamoto mcp-florence2 up to 0.3.13
Timeline
- 2026-08-17: disclosed
- other: Exploit published