Executive brief
sentry-selfhosted-mcp is an MCP server that provides programmatic access to self-hosted Sentry instances for retrieving and managing error tracking data. A server-side request forgery (SSRF) vulnerability in the raw_sentry_api tool allows an attacker who can invoke the tool to make the server send HTTP requests to arbitrary internal or external destinations, potentially exposing internal service data, APIs, or metadata endpoints.
Technical details
The vulnerability exists in the raw_sentry_api tool handler (src/index.ts, lines 902–930), which accepts a caller-controlled endpoint argument and passes it directly to Axios request methods (GET, POST, PUT, DELETE) without proper validation. Axios processes absolute URLs, allowing an attacker to specify any URL as the endpoint parameter instead of being restricted to the configured Sentry base URL. The attack requires only the ability to invoke the raw_sentry_api MCP tool; no additional authentication bypass is needed. An attacker can reach internal services, metadata endpoints, or other HTTP-accessible resources on the server's network. The fix requires normalizing endpoint as a relative path, joining it safely with the base Sentry URL, and rejecting absolute URLs and internal destination ranges.
Affected products
- ddfourtwo sentry-selfhosted-mcp 0.4.0
Timeline
- 2026-07-12: disclosed
- 2026-08-27: advisory