Junglewise Threat Intelligence

CVE-2026-7221: TencentCloudBase CloudBase-MCP SSRF in open-url API Endpoint

CVE-2026-7221 · Severity: high · CVSS 7.3 · Published 2026-04-28

Vendors: Tencent.

Executive brief

TencentCloudBase CloudBase-MCP, a toolkit for building AI coding agents, contains a security flaw in its interactive server component. An attacker can exploit this to force the server to make unauthorized requests to internal systems or external websites. This could lead to the exposure of sensitive internal data or allow the attacker to bypass network security controls.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the `openUrl` function within `mcp/src/interactive-server.ts`. The `open-url` API endpoint fails to properly validate the `req.body.url` argument, allowing unauthenticated remote attackers to submit malicious URLs. This can be used to target internal loopback addresses, private RFC 1918 networks, or cloud metadata services (e.g., 169.254.169.254). The vulnerability is exacerbated by the server defaulting to bind to all interfaces (0.0.0.0). Version 2.17.1 addresses this by implementing a strict `isUrlSafeToOpen()` validation check and changing the default bind address to 127.0.0.1.

Affected products

  • TencentCloudBase CloudBase-MCP <= 2.17.0

Timeline

  • 2026-04-10: other: Automated fix attempt and pull request created
  • 2026-04-13: patched: Fix merged into main branch
  • 2026-04-28: disclosed: Vulnerability published and CVE assigned

References