Executive brief
mcp-webresearch is a tool that allows AI models to browse and research the web. A security flaw allows attackers to trick the tool into visiting internal company websites or cloud management services instead of public websites. This could lead to the theft of sensitive internal data, including cloud credentials and private server information.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the visit_page tool of mcp-webresearch due to insufficient validation of user-supplied URLs. The isValidUrl function only verifies that the protocol is http or https, failing to filter loopback, link-local, or private IP ranges. An attacker can use prompt injection to influence the LLM-controlled URL argument, forcing the server's Playwright browser to navigate to internal endpoints like the AWS/GCP metadata service (169.254.169.254). Because Playwright follows redirects and the tool returns page content to the model context, sensitive information such as IAM credentials can be exfiltrated. The repository was archived in February 2025, and no official patch is currently available.
Affected products
- mzxrai mcp-webresearch <= 0.1.7
Timeline
- 2025-02-13: other: Repository archived by owner
- 2026-07-21: advisory: Vulnerability disclosed by VulnCheck
- 2026-07-21: disclosed: CVE-2026-65056 published